Answers: <p>This sounds like you are applying Ansible playbooks locally on peoples workstations.</p>
  <p>The best way to protect this would be applying the playbooks using a remote system, like <a href="https://github.com/ansible/awx" rel="nofollow noreferrer">AWX</a> or a CI system such as <a href="https://github.com/features/actions" rel="nofollow noreferrer">GitHub Actions</a> or <a href="https://www.jetbrains.com/teamcity/" rel="nofollow noreferrer">TeamCity</a>. The CI system would have the ability to decrypt the vault and run the playbooks.</p>
  <p>Mostly the CI system can expose the vault password to the job using an environment variable (that is hidden from end users and from the logs). You can then write a simple script which provides the password to the vault. Details here: <a href="https://docs.ansible.com/ansible/latest/user_guide/vault.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/user_guide/vault.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts</a></p>
  <p>For example:</p>
  <pre class="lang-py prettyprint-override"><code>#!/usr/bin/env python
  
  import os
  import sys
  
  if &quot;ANSIBLE_VAULT_PASS&quot; in os.environ:
    sys.stdout.write('%s\n' % os.environ['ANSIBLE_VAULT_PASS'])
    sys.exit(0)
  
  sys.exit(1)
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-07-21T09:57:50.120Z
Answers: 2021-07-21T09:57:50.120Z
Answers: Matthew Hodgkins
Body: <p>Historically we've been a one man devops team and stored all our passwords in Ansible vaults - including things like domain admin passwords and root account passwords.</p>
  <p>However we're now growing and adding new team members and this creates a challenge. If we give all members of the devops team the vault and vault password they all suddenly have domain admin and root credentials - which we're hesitant to do. Some members of our team are more junior and we're trying to avoid handing out proverbial keys to the kingdom to everyone on the team.</p>
  <p>However the Ansible scripts still need these credentials to function - to do things like join a windows active directory domain.</p>
  <p>Is there a way with Ansible, Ansible tower or awx to grant a devops person the ability to use a credential without being able to decrypt and read it in clear text?</p>
  <p>If not what other strategies do their teams use to address this situation?</p>
  
Comments: CC BY-SA 4.0
Comments: 2021-07-12T17:52:29.650Z
Comments: IMHO, practically, it's not possible from the command line. To use a secret a playbook must be able to decrypt it. This means the secret is visible in some scope of a playbook. You'll have to prevent the administrator, who is running the playbook, from modifying the code, seeing the logs, etc. Moreover, this administrator shouldn't be able to debug such playbooks. There might be suitable [credentials](https://docs.ansible.com/ansible-tower/latest/html/userguide/credentials.html#getting-started-with-credentials) in AWX.
Comments: Vladimir Botka
Tags: <ansible><security><passwords>
Title: Strategies for sharing Ansible vaults with root/administrator credentials?
UserDisplayName: Brad
ThreadText: # Strategies for sharing Ansible vaults with root/administrator credentials?
  
  (Asked by: username_0 on 2021-07-12)
  
  Historically we've been a one man devops team and stored all our passwords in Ansible vaults - including things like domain admin passwords and root account passwords.
  
  However we're now growing and adding new team members and this creates a challenge. If we give all members of the devops team the vault and vault password they all suddenly have domain admin and root credentials - which we're hesitant to do. Some members of our team are more junior and we're trying to avoid handing out proverbial keys to the kingdom to everyone on the team.
  
  However the Ansible scripts still need these credentials to function - to do things like join a windows active directory domain.
  
  Is there a way with Ansible, Ansible tower or awx to grant a devops person the ability to use a credential without being able to decrypt and read it in clear text?
  
  If not what other strategies do their teams use to address this situation?
  
  **Tags:** ansible, security, passwords
  
  > **Comments:**
  > **username_1**: IMHO, practically, it's not possible from the command line. To use a secret a playbook must be able to decrypt it. This means the secret is visible in some scope of a playbook. You'll have to prevent the administrator, who is running the playbook, from modifying the code, seeing the logs, etc. Moreover, this administrator shouldn't be able to debug such playbooks. There might be suitable [credentials](https://docs.ansible.com/ansible-tower/latest/html/userguide/credentials.html#getting-started-with-credentials) in AWX.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2021-07-21. Score: 1
  
  This sounds like you are applying Ansible playbooks locally on peoples workstations.
  
  The best way to protect this would be applying the playbooks using a remote system, like [AWX](https://github.com/ansible/awx) or a CI system such as [GitHub Actions](https://github.com/features/actions) or [TeamCity](https://www.jetbrains.com/teamcity/). The CI system would have the ability to decrypt the vault and run the playbooks.
  
  Mostly the CI system can expose the vault password to the job using an environment variable (that is hidden from end users and from the logs). You can then write a simple script which provides the password to the vault. Details here: <https://docs.ansible.com/ansible/latest/user_guide/vault.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts>
  
  For example:
  
  ```py
  #!/usr/bin/env python
  
  import os
  import sys
  
  if "ANSIBLE_VAULT_PASS" in os.environ:
    sys.stdout.write('%s\n' % os.environ['ANSIBLE_VAULT_PASS'])
    sys.exit(0)
  
  sys.exit(1)
  
  ```
  
  
  ---
  
  