DevOps Stack Exchange is a question and answer site for software engineers working on automated testing, continuous delivery, service integration and monitoring, and building SDLC infrastructure. It only takes a minute to sign up.
Sign up to join this community
Scenario: Deploy 30 VMs using terraform and then run ansible - how many ssh keys do you generate? Virtual machine definition in terraform requires administrator ssh key or password provided.
Do you provide only the public key of ansible control node? Or do you create ssh keys for each and every VM? If the latter is true, how do you automate that and configure ansible inventory?
There are pros and cons for both options:
A single master key for your Ansible account would reduce complexity but you would need to ensure the private key is very secure, even if the key were password protected you would want to ensure the key is encrypted at rest with a tool like BlackBox and backed up somewhere.
System unique SSH keys would help with security but it's preferable to have a tool like HashiCorp Vault to help manage access to those keys. This shifts the security burden onto your secrets server but the added benefits could offset the extra work involved with setting it up and locking down access.
Another way you can go about this is to have a master Ansible ssh key but prevent root level access on the account and use something like PowerBroker to control and log privilege escalation from Ansible.
