How to configure Ansible with least-privilege Azure credentials for secure automation

Question

Could you explain how to create a service principal with only the permissions needed for specific Azure resources, where to store its credentials safely (e.g., environment variables, Azure Key Vault, or restricted file permissions), how to configure Ansible to avoid logging secrets, and how to enforce least privilege on the control node itself? Please include considerations for using ansible.cfg to disable logging of variable values, setting file permissions on credential files, and limiting the Azure role assignments to the minimum required.

Tasadduq Burney · Answer

To secure Ansible automation in Azure, you must move away from global administrative credentials toward Service Principals (SP) with scoped Role-Based Access Control (RBAC) and strict secret handling on the control node.

1. Create a Least-Privilege Service Principal
>Instead of assigning the 'Owner' role at the subscription level, create a Service Principal limited to the specific Resource Group or resource required for the task.

Generate the SP using: az ad sp create-for-app --name "Ansible-Automation" --show-service-auth
  Assign only the necessary role (e.g., 'Virtual Machine Contributor' or 'Network Contributor') to the specific scope using: 
  az role assignment create --role "Virtual Machine Contributor" --spn  --scope /subscriptions//resourcegroups/

2. Store and Inject Credentials Safely
>Avoid hardcoding secrets in playbooks. Use environment variables or Azure Key Vault for injection.

Environment Variables: Set AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID on the control node. Ansible Azure modules automatically pick these up.
  Restricted File Permissions: If using a file for credentials, ensure it is owned by the ansible user and restricted: 
  chmod 600 ~/.azure/servicecredentials.json
chown ansible:ansible ~/.azure/servicecredentials.jsonn  Azure Key Vault: Use the azure.azcollection.keyvault collection to fetch secrets at runtime, keeping them off the disk.

3. Configure Ansible to Prevent Secret Logging
>To stop sensitive data from appearing in stdout or CI/CD logs, modify your ansible.cfg file.
[defaults]
tansible_logging = False
ansible_stdout_callback = minimal
Note: While ansible_logging = False stops local log files, use the no_log: true attribute on specific tasks that handle secrets to prevent them from appearing in the console output.
- name: Deploy VM
  azure.azcollection.azure_rm_vm:
  no_log: true

4. Harden Control Node
>The machine running Ansible should be as secure as the target environment.

Run Ansible under a dedicated service user with limited sudo privileges.
  Utilize Ansible Vault to encrypt any variables that must be stored in your repository.
  Limit network access from the control node to only the Azure API endpoints and the target management subnets.

Are you running these tasks from a persistent VM or within an ephemeral CI/CD runner like GitHub Actions or GitLab Runner?

How to configure Ansible with least-privilege Azure credentials for secure automation

1 answer

To secure Ansible automation in Azure, you must move away from global administrative credentials toward Service Principals (SP) with scoped Role-Based Access Control (RBAC) and strict secret handling on the control node.

1. Create a Least-Privilege Service Principal

2. Store and Inject Credentials Safely

3. Configure Ansible to Prevent Secret Logging

4. Harden Control Node

Your perspective belongs here.

1 question comment