Historically we've been a one man devops team and stored all our passwords in Ansible vaults - including things like domain admin passwords and root account passwords.

However we're now growing and adding new team members and this creates a challenge. If we give all members of the devops team the vault and vault password they all suddenly have domain admin and root credentials - which we're hesitant to do. Some members of our team are more junior and we're trying to avoid handing out proverbial keys to the kingdom to everyone on the team.

However the Ansible scripts still need these credentials to function - to do things like join a windows active directory domain.

Is there a way with Ansible, Ansible tower or awx to grant a devops person the ability to use a credential without being able to decrypt and read it in clear text?

If not what other strategies do their teams use to address this situation?

  • IMHO, practically, it's not possible from the command line. To use a secret a playbook must be able to decrypt it. This means the secret is visible in some scope of a playbook. You'll have to prevent the administrator, who is running the playbook, from modifying the code, seeing the logs, etc. Moreover, this administrator shouldn't be able to debug such playbooks. There might be suitable credentials in AWX. Jul 12 at 17:52

This sounds like you are applying Ansible playbooks locally on peoples workstations.

The best way to protect this would be applying the playbooks using a remote system, like AWX or a CI system such as GitHub Actions or TeamCity. The CI system would have the ability to decrypt the vault and run the playbooks.

Mostly the CI system can expose the vault password to the job using an environment variable (that is hidden from end users and from the logs). You can then write a simple script which provides the password to the vault. Details here: https://docs.ansible.com/ansible/latest/user_guide/vault.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts

For example:

#!/usr/bin/env python

import os
import sys

if "ANSIBLE_VAULT_PASS" in os.environ:
  sys.stdout.write('%s\n' % os.environ['ANSIBLE_VAULT_PASS'])


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.