CIS Ansible Automation Platform Benchmark

This recommendation verifies that Ansible is up to date on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Ansible version:
ansible --version
ansible-playbook --version
pip show ansible-core | grep Version

# Update Ansible to latest stable:
pip install --upgrade ansible-core
# or via package manager:
sudo dnf update -y ansible-core

This recommendation verifies that ansible.cfg is securely configured on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check ansible.cfg location and settings:
ansible-config dump --only-changed
ansible-config view
ls -la /etc/ansible/ansible.cfg ~/.ansible.cfg ./ansible.cfg

# Secure ansible.cfg:
[defaults]
forks = 20
host_key_checking = True
no_log = False
retry_files_enabled = False

[privilege_escalation]
become = False
become_method = sudo
become_ask_pass = True

[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=yes

This recommendation verifies that vault passwords are not stored in plaintext on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check vault configuration:
ansible-vault --version
ls -la ~/.vault_pass* 2>/dev/null
grep 'vault_password_file' ansible.cfg

# Never store vault password in plaintext files:
# Use environment-based or prompt-based vault password:
export ANSIBLE_VAULT_PASSWORD_FILE=/path/to/vault-pass-client.py

# vault-pass-client.py should fetch from secrets manager:
#!/usr/bin/env python3
import subprocess
print(subprocess.check_output(['aws', 'secretsmanager', 'get-secret-value', '--secret-id', 'ansible-vault']).decode().strip())

This setting ensures that inventory files have restricted permissions on the Ansible Automation Platform configuration management tool. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Ansible Automation Platform configuration management tool is essential for defense in depth.

# Check inventory file permissions:
ls -la /etc/ansible/hosts ./inventory/ ./hosts
stat -c '%a %U:%G %n' /etc/ansible/hosts 2>/dev/null

# Restrict inventory file access:
chmod 640 /etc/ansible/hosts
chown root:ansible /etc/ansible/hosts

# Use dynamic inventory instead of static files:
# ansible.cfg: inventory = ./dynamic_inventory.py

This recommendation verifies that sensitive inventory variables are vault-encrypted on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check for plaintext passwords in inventory:
grep -rn 'ansible_password\|ansible_ssh_pass\|ansible_become_pass' inventory/ /etc/ansible/hosts

# Encrypt sensitive inventory variables:
ansible-vault encrypt inventory/group_vars/all/vault.yml

# Use vault-encrypted variables:
# vault.yml:
# vault_db_password: encrypted_value
# main.yml:
# db_password: "{{ vault_db_password }}"

This recommendation verifies that no_log is used for sensitive tasks on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check for no_log usage on sensitive tasks:
grep -rn 'no_log' playbooks/ roles/
grep -rn 'password\|secret\|token\|key' playbooks/ roles/ | grep -v no_log | grep -v '.vault'

# Add no_log to tasks handling sensitive data:
# - name: Set database password
#   mysql_user:
#     name: admin
#     password: "{{ vault_db_password }}"
#   no_log: true

This setting ensures that shell and command modules are minimized on the Ansible Automation Platform configuration management tool. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Ansible Automation Platform configuration management tool is essential for defense in depth.

# Check for shell/command module usage:
grep -rn 'shell:\|command:\|raw:' playbooks/ roles/ | wc -l
grep -rn 'shell:\|command:' playbooks/ roles/ | head -20

# Replace shell/command with specific modules:
# BAD:
# - shell: useradd -m newuser
# GOOD:
# - user:
#     name: newuser
#     create_home: yes
#     state: present

# Use ansible-lint to catch these:
ansible-lint playbooks/ -R -r ~/.ansible/rules/

This recommendation verifies that ansible-lint is used for playbook validation on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Lint playbooks for security issues:
ansible-lint --version
ansible-lint playbooks/*.yml 2>&1 | head -30

# Install and configure ansible-lint:
pip install ansible-lint

# Create .ansible-lint config:
# .ansible-lint:
# enable_list:
#   - no-changed-when
#   - no-jinja-when
#   - command-instead-of-shell
# warn_list:
#   - experimental

ansible-lint playbooks/ roles/

This recommendation verifies that collection and role versions are pinned on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List installed collections and roles:
ansible-galaxy collection list
ansible-galaxy role list
ls -la ~/.ansible/collections/ ~/.ansible/roles/

# Pin collection versions in requirements.yml:
# requirements.yml:
# collections:
#   - name: community.general
#     version: ">=9.0.0,<10.0.0"
#   - name: ansible.posix
#     version: "1.5.4"

ansible-galaxy collection install -r requirements.yml --force

This recommendation verifies that collection signatures are verified on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check collection signature verification:
ansible-galaxy collection verify community.general 2>&1
grep 'gpg' ansible.cfg

# Enable collection signature verification:
# ansible.cfg:
[galaxy]
gpg_keyring = ~/.ansible/pubring.kbx

# Import Ansible Galaxy signing key:
gpg --import ansible-galaxy-pubkey.asc

# Verify before install:
ansible-galaxy collection install community.general --keyring ~/.ansible/pubring.kbx

This recommendation verifies that privilege escalation is targeted per task on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check become/privilege escalation settings:
ansible-config dump | grep -i become
grep -rn 'become:' playbooks/ roles/ | head -20

# Use targeted privilege escalation:
# Per-task become (not play-wide):
# - name: Install package
#   apt:
#     name: nginx
#   become: true
#   become_method: sudo

# Configure sudoers for least privilege:
# ansible ALL=(ALL) NOPASSWD: /usr/bin/apt-get, /usr/bin/systemctl

This recommendation verifies that SSH keys and pipelining are properly configured on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSH key configuration:
ssh-add -l
grep 'private_key_file\|ssh_args' ansible.cfg

# Configure SSH with strong keys:
# ansible.cfg:
[defaults]
private_key_file = ~/.ssh/ansible_ed25519

[ssh_connection]
ssh_args = -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=~/.ssh/known_hosts
pipelining = True

This recommendation verifies that Ansible logging is enabled on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Ansible logging:
ansible-config dump | grep -i log
ls -la /var/log/ansible* 2>/dev/null

# Enable logging in ansible.cfg:
[defaults]
log_path = /var/log/ansible/ansible.log

# Create log directory:
mkdir -p /var/log/ansible
chown ansible:ansible /var/log/ansible
chmod 750 /var/log/ansible

# Enable callback plugins for detailed logging:
[defaults]
callback_whitelist = timer, profile_tasks, log_plays

This recommendation verifies that callback plugins record playbook runs on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check callback plugins:
ansible-config dump | grep callback
ansible-doc -t callback -l

# Enable ARA callback for playbook recording:
pip install ara[server]

# ansible.cfg:
[defaults]
callback_plugins = $(python3 -m ara.setup.callback_plugins)

# View run history:
ara playbook list
ara result list

This recommendation verifies that AWX session and authentication settings are hardened on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check AWX/Controller settings:
awx-manage --version 2>/dev/null
curl -sk https://awx.example.com/api/v2/settings/authentication/ -H 'Authorization: Bearer $AWX_TOKEN' | jq .

# Configure AWX security settings:
# Via API:
curl -sk -X PATCH https://awx.example.com/api/v2/settings/authentication/ \
  -H 'Authorization: Bearer $AWX_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"SESSION_COOKIE_AGE": 1800, "SESSIONS_PER_USER": 3, "AUTH_BASIC_ENABLED": false}'

This recommendation verifies that credentials use external vault integration on the Ansible Automation Platform configuration management tool. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ansible Automation Platform configuration management tool vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check AWX credential types:
curl -sk https://awx.example.com/api/v2/credentials/ \
  -H 'Authorization: Bearer $AWX_TOKEN' | \
  jq '.results[] | {name, credential_type: .summary_fields.credential_type.name}'

# Use external credential lookups:
# AWX > Settings > Jobs > External Credential Vault
# Configure HashiCorp Vault as external credential provider
# Use machine credentials over passwords
# Rotate credentials regularly via AWX credential API