# BAD: Hardcoded sensitive valuesdatabase_password: "plaintext_password"# GOOD: Use Ansible Vaultdatabase_password: "{{ vault_database_password }}"# GOOD: Environment variables for CI/CDapi_key: "{{ lookup('env', 'API_KEY') }}"

# Use become only when necessary
- name: Install packagepackage:
name: nginxbecome: true # Only when root is required# Validate inputs
- name: Create useruser:
name: "{{ username }}"when: - username is defined
- username | length > 0
- username is match('^[a-z][a-z0-9_-]*$')# Use no_log for sensitive operations
- name: Set passworduser:
name: "{{ username }}"password: "{{ password | password_hash('sha512') }}"no_log: true# Validate file permissions
- name: Create config filetemplate:
src: config.j2dest: /etc/app/configowner: appgroup: appmode: '0600'# Restrict access

# ansible.cfg - Secure connection settings[defaults]host_key_checking = Truessh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=yestimeout = 30[ssh_connection]ssh_args = -o StrictHostKeyChecking=yes -o PasswordAuthentication=nocontrol_path_dir = ~/.ansible/cp

# inventories/production/group_vars/all/vault.yml (encrypted)
---
vault_database_password: "SecureDBPassword123!"vault_api_key: "sk-1234567890abcdef"vault_ssl_private_key: | -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC... -----END PRIVATE KEY-----# inventories/production/group_vars/all/vars.yml (plain text)
---
database_password: "{{ vault_database_password }}"api_key: "{{ vault_api_key }}"ssl_private_key: "{{ vault_ssl_private_key }}"

# SSH configuration enforced by hardening rolesshd_config_settings:
Protocol: 2PermitRootLogin: noPasswordAuthentication: noChallengeResponseAuthentication: noUsePAM: yesX11Forwarding: noPrintMotd: noClientAliveInterval: 600ClientAliveCountMax: 0MaxAuthTries: 3MaxSessions: 2LoginGraceTime: 30AllowGroups: ssh-users

ENABLE_2FA: true

# Secure user creation with users_add roleusers_add_userlist:
- username: "john_doe"public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... john@secure-laptop"admin: false # Principle of least privilegenon_admin_allowed_commands: "NOPASSWD: /usr/bin/systemctl status *, /usr/bin/journalctl -f"# Specific, limited sudo commands only

# PAM password quality settings (managed by hardening role)pwquality_settings:
minlen: 14# Minimum password lengthminclass: 3# Minimum character classesmaxrepeat: 2# Maximum repeated charactersmaxsequence: 3# Maximum sequence lengthdcredit: -1# Require digitsucredit: -1# Require uppercaselcredit: -1# Require lowercaseocredit: -1# Require special characters

# Service accounts with minimal privileges
- name: Create application service accountuser:
name: app_servicesystem: yesshell: /bin/false # No shell accesshome: /var/lib/app # Dedicated home directorycreate_home: yesbecome: true
- name: Set application directory permissionsfile:
path: /var/lib/appowner: app_servicegroup: app_servicemode: '0750'# Limited access

# Additional hardening beyond CIS baselinesecurity_extensions:
# Kernel securitykernel_parameters:
kernel.dmesg_restrict: 1kernel.kptr_restrict: 2kernel.unprivileged_bpf_disabled: 1# Network securitynetwork_parameters:
net.ipv4.tcp_syncookies: 1net.ipv4.conf.all.rp_filter: 1net.ipv6.conf.all.disable_ipv6: 1# File system securityfilesystem_parameters:
fs.suid_dumpable: 0fs.protected_hardlinks: 1fs.protected_symlinks: 1

# Basic UFW configuration via hardening roleufw_configuration:
default_incoming: denydefault_outgoing: allowdefault_routed: denyufw_rules:
- rule: allowport: '22'proto: tcpsrc: '192.168.1.0/24'# Restrict SSH to specific networks
- rule: allowport: '80'proto: tcp
- rule: allowport: '443'proto: tcp
- rule: denyport: '23'# Deny telnetproto: tcp

secrets_classification:
public:
- Application configurations (non-sensitive)
- Public SSL certificates
- Documentationinternal:
- Internal API endpoints
- Service discovery configurations
- Non-production credentialsconfidential:
- Database passwords
- API keys
- SSL private keys
- Production credentialsrestricted:
- Root certificates
- Master encryption keys
- Recovery codes

# Vault integration example
- name: Retrieve secret from Vaulturi:
url: "{{ vault_url }}/v1/secret/data/myapp"method: GETheaders:
X-Vault-Token: "{{ vault_token }}"register: vault_response
- name: Use secret in tasktemplate:
src: config.j2dest: /etc/app/configvars:
db_password: "{{ vault_response.json.data.data.password }}"no_log: true

# Centralized logging configurationrsyslog_configuration:
# Forward logs to central serverforward_logs: truelog_server: "log-collector.example.com:514"# Local log retentionlog_retention_days: 90# Log rotationlog_rotation:
daily: truecompress: truemax_age: 30

# Example monitoring tasks
- name: Check for failed SSH attemptsshell: grep "Failed password" /var/log/auth.log | tail -10register: failed_sshchanged_when: false
- name: Alert on suspicious activitymail:
subject: "Security Alert: Failed SSH attempts on {{ inventory_hostname }}"body: "{{ failed_ssh.stdout }}"to: security@example.comwhen: failed_ssh.stdout_lines | length > 5

# Unattended upgrades configurationunattended_upgrades:
enabled: trueorigins_patterns:
- "origin=Ubuntu,archive=${distro_codename}-security"
- "o=Ubuntu,a=${distro_codename}-updates"package_blacklist:
- kernel* # Exclude kernel updates (require manual reboot)automatic_reboot: falseemail_notifications: "admin@example.com"

controls_mapping:
access_control:
frameworks: [SOC2, ISO27001, PCI_DSS]implementations:
- SSH key-based authentication
- Multi-factor authentication
- Principle of least privilege
- Regular access reviewsencryption:
frameworks: [SOC2, ISO27001, PCI_DSS, GDPR]implementations:
- TLS 1.3 for data in transit
- AES-256 for data at rest
- SSH encryption for management
- Ansible Vault for secretslogging_monitoring:
frameworks: [SOC2, ISO27001, PCI_DSS]implementations:
- Centralized log collection
- Real-time monitoring
- Audit trail maintenance
- Security event alerting

# Recovery playbook example
- name: Emergency security responsehosts: compromised_systemstasks:
- name: Reset compromised passwordsuser:
name: "{{ item }}"password: "{{ lookup('password', '/tmp/new_passwords/' + item) | password_hash('sha512') }}"loop: "{{ compromised_users }}"no_log: true
- name: Update all packagespackage:
name: "*"state: latest
- name: Restart security servicessystemd:
name: "{{ item }}"state: restartedloop:
- ssh
- ufw
- auditd

security_metrics:
technical:
- Mean time to patch (MTTP)
- Number of critical vulnerabilities
- Failed authentication attempts
- Security incidents per month
- System uptime and availabilityoperational:
- Security training completion rate
- Incident response time
- Access review completion rate
- Policy compliance percentage
- Security tool effectivenessbusiness:
- Cost of security incidents
- Customer trust metrics
- Regulatory compliance status
- Security ROI measurements
- Business continuity metrics