Managing Secrets Securely

# Install the AWS collection
ansible-galaxy collection install amazon.aws

---
- name: Deploy application with AWS Secrets Manager
  hosts: appservers
  become: true

  vars:
    # Fetch secrets at runtime from AWS Secrets Manager
    # The IAM role on the control node must have secretsmanager:GetSecretValue
    db_password: "{{ lookup('amazon.aws.aws_secret',
                    'prod/myapp/db_password',
                    region='us-east-1') }}"

    api_key: "{{ lookup('amazon.aws.aws_secret',
                 'prod/myapp/api_key',
                 region='us-east-1') }}"

  tasks:
    - name: Deploy application configuration
      ansible.builtin.template:
        src: app.conf.j2
        dest: /etc/app/config.conf
      # In app.conf.j2:
      # db_password = {{ db_password }}
      # api_key     = {{ api_key }}
      no_log: true    # prevent secret values from appearing in output

# Install the HashiCorp Vault collection
ansible-galaxy collection install community.hashi_vault

# Set the Vault address and token in environment (or ansible.cfg)
export VAULT_ADDR=https://vault.example.com
export VAULT_TOKEN=s.abc123xyz

---
- name: Deploy with HashiCorp Vault secrets
  hosts: databases
  become: true

  vars:
    # KV secrets engine — retrieve a static secret
    db_password: "{{ lookup('community.hashi_vault.hashi_vault',
                    'secret=secret/data/myapp/db_password:value
                     url=https://vault.example.com
                     auth_method=token') }}"

    # Dynamic database credentials — created per-request, expire automatically
    # Requires a Vault database secrets engine configured for PostgreSQL
    pg_credentials: "{{ lookup('community.hashi_vault.hashi_vault',
                         'secret=database/creds/myapp-role
                          url=https://vault.example.com
                          auth_method=approle
                          role_id={{ vault_role_id }}
                          secret_id={{ vault_secret_id }}') }}"

  tasks:
    - name: Create database user with dynamic credentials
      community.postgresql.postgresql_user:
        name: "{{ pg_credentials.username }}"
        password: "{{ pg_credentials.password }}"
        state: present
      become_user: postgres
      no_log: true
      # These credentials expire in 1 hour — Vault creates and revokes them

#!/usr/bin/env python3
# scripts/get_vault_password.py
# Makes this file executable: chmod +x scripts/get_vault_password.py

import boto3
import json
import sys

def get_vault_password():
    """Retrieve vault password from AWS Secrets Manager."""
    client = boto3.client('secretsmanager', region_name='us-east-1')
    try:
        response = client.get_secret_value(SecretId='ansible/vault-password')
        # Secret stored as plain string
        print(response['SecretString'])
    except Exception as e:
        print(f"Error retrieving vault password: {e}", file=sys.stderr)
        sys.exit(1)

if __name__ == '__main__':
    get_vault_password()

# ansible.cfg — point to the script instead of a static file
[defaults]
vault_password_file = ./scripts/get_vault_password.py

# The script must be executable
chmod +x scripts/get_vault_password.py

# Test the script directly before using it with Ansible
./scripts/get_vault_password.py    # should print the vault password to stdout

# Now ansible-playbook automatically calls the script at runtime
ansible-playbook site.yml -i inventory/production/