Scenario: Deploy 30 VMs using terraform and then run ansible - how many ssh keys do you generate? Virtual machine definition in terraform requires administrator ssh key or password provided.

Do you provide only the public key of ansible control node? Or do you create ssh keys for each and every VM? If the latter is true, how do you automate that and configure ansible inventory?

1 Answer 1


There are pros and cons for both options:

A single master key for your Ansible account would reduce complexity but you would need to ensure the private key is very secure, even if the key were password protected you would want to ensure the key is encrypted at rest with a tool like BlackBox and backed up somewhere.

System unique SSH keys would help with security but it's preferable to have a tool like HashiCorp Vault to help manage access to those keys. This shifts the security burden onto your secrets server but the added benefits could offset the extra work involved with setting it up and locking down access.

Another way you can go about this is to have a master Ansible ssh key but prevent root level access on the account and use something like PowerBroker to control and log privilege escalation from Ansible.

  • Thank you! Hashicorp Vault solution looks cool, I think it could be used for CI/CD as well - just copy the password to a file and read it during playbook execution. Since it's one-time only, no issue to just leave this alone :D Very cool solutions, haven't seen them anywhere during my research. Quite complicated I must say as well. I think I'm going to try AWX for now, since it has vault support "out of the box" and allows remote execution. I'll use only one key but it will be much easier to lock down. Thanks again for linking these solutions!
    – dywan666
    Commented Jul 28, 2021 at 15:14
  • No problem! AWX has bugs but is a great tool, currently using it extensively.
    – Josh Zhang
    Commented Jul 28, 2021 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.