auditing-ansible-become-and-vault-trustlisted

Audit configuration-management privilege escalation and secret handling for trust that runs as root on every managed host: a task that escalates with become across a whole play when only one step needs it, a role or variable sourced from an untrusted place that runs under that escalation, a vault-encrypted secret whose decryption key is exposed to the runner or logged, and a templated value or module argument that takes attacker-influenceable input while privileged. Covers Ansible and similar agentless tools where a control node runs plays that escalate privilege and decrypt secrets across a fleet. Use when playbooks escalate with become or handle vault secrets across managed hosts. The untrusted role, variable, or input running under escalation is the source, the privileged task or decrypted secret is the sink, and the over-broad escalation or exposed key is the bug.
UnboundCompute/security-agent-skills · ★ 4 · AI & Automation · score 80

Install: claude install-skill UnboundCompute/security-agent-skills

# Auditing Ansible become and vault trust: when the control node runs as root everywhere An agentless configuration tool is a fleet-wide root shell with a scheduler. The control node connects to every managed host and runs tasks that escalate privilege, and it decrypts the secrets those tasks need. Two trust questions decide the blast radius. First, escalation scope: become is often set at the play or role level so every task runs privileged, and any role, variable, or templated input that flows into those tasks runs as root on every host it touches. Second, secret handling: vault-encrypted values are only as protected as the decryption key, and a key exposed to the runner, passed on a command line, or logged is a fleet-wide secret leak. When a play escalates and decrypts across many hosts, an untrusted role or an exposed key is not one host's problem. You audit this by scoping where escalation applies and tracing what runs under it, and by checking how vault secrets are decrypted and whether the key or the plaintext leaks. ## When to use - Playbooks escalate privilege with become across managed hosts, often at the play or role level. - Roles, collections, or variables come from shared or external sources and run under that escalation. - Vault-encrypted secrets are decrypted on the control node, and the key or plaintext handling may leak. ## Scope check Audit playbooks and vault handling only for fleets and control nodes you own or are authorized to assess, on non-produc