<p>There are pros and cons for both options:</p>
<p>A single master key for your Ansible account would reduce complexity but you would need to ensure the private key is <strong>very</strong> secure, even if the key were password protected you would want to ensure the key is encrypted at rest with a tool like <a href="https://github.com/StackExchange/blackbox" rel="nofollow noreferrer">BlackBox</a> and backed up somewhere.</p>
<p>System unique SSH keys would help with security but it's preferable to have a tool like <a href="https://www.vaultproject.io/" rel="nofollow noreferrer">HashiCorp Vault</a> to help <a href="https://www.infralovers.com/en/articles/2021/03/03/hashicorp-vault-and-ssh-with-ansibleterraform/" rel="nofollow noreferrer">manage access to those keys</a>. This shifts the security burden onto your secrets server but the added benefits could offset the extra work involved with setting it up and locking down access.</p>
<p>Another way you can go about this is to have a master Ansible ssh key but prevent root level access on the account and use something like <a href="https://www.beyondtrust.com/privilege-management/unix-linux" rel="nofollow noreferrer">PowerBroker</a> to control and log privilege escalation from <a href="https://docs.ansible.com/ansible/latest/collections/community/general/pbrun_become.html" rel="nofollow noreferrer">Ansible</a>.</p>

CC BY-SA 4.0
2021-07-28T15:14:04.753Z
Thank you! Hashicorp Vault solution looks cool, I think it could be used for CI/CD as well - just copy the password to a file and read it during playbook execution. Since it's one-time only, no issue to just leave this alone :D 

Very cool solutions, haven't seen them anywhere during my research. Quite complicated I must say as well. I think I'm going to try AWX for now, since it has vault support "out of the box" and allows remote execution. I'll use only one key but it will be much easier to lock down. Thanks again for linking these solutions!
dywan666
CC BY-SA 4.0
2021-07-28T15:27:47.380Z
No problem! AWX has bugs but is a great tool, currently using it extensively.
Josh Zhang
CC BY-SA 4.0
2021-07-26T15:48:13.420Z
2021-07-26T16:32:47.350Z
2021-07-26T16:32:47.350Z
Josh Zhang
<p><strong>Scenario:</strong> Deploy 30 VMs using terraform and then run ansible - how many ssh keys do you generate? Virtual machine definition in terraform requires administrator ssh key or password provided.</p>
<p>Do you provide only the public key of ansible control node? Or do you create ssh keys for each and every VM? If the latter is true, how do you automate that and configure ansible inventory?</p>

<ansible><terraform><cloud><ssh>
Root ssh key for ansible control node
dywan666
# Root ssh key for ansible control node

(Asked by: username_0 on 2021-07-26)

**Scenario:** Deploy 30 VMs using terraform and then run ansible - how many ssh keys do you generate? Virtual machine definition in terraform requires administrator ssh key or password provided.

Do you provide only the public key of ansible control node? Or do you create ssh keys for each and every VM? If the latter is true, how do you automate that and configure ansible inventory?

**Tags:** ansible, terraform, cloud, ssh


---

## 1 answers

### Answer by username_1 on 2021-07-26. Score: 1 | Accepted answer

There are pros and cons for both options:

A single master key for your Ansible account would reduce complexity but you would need to ensure the private key is **very** secure, even if the key were password protected you would want to ensure the key is encrypted at rest with a tool like [BlackBox](https://github.com/StackExchange/blackbox) and backed up somewhere.

System unique SSH keys would help with security but it's preferable to have a tool like [HashiCorp Vault](https://www.vaultproject.io/) to help [manage access to those keys](https://www.infralovers.com/en/articles/2021/03/03/hashicorp-vault-and-ssh-with-ansibleterraform/). This shifts the security burden onto your secrets server but the added benefits could offset the extra work involved with setting it up and locking down access.

Another way you can go about this is to have a master Ansible ssh key but prevent root level access on the account and use something like [PowerBroker](https://www.beyondtrust.com/privilege-management/unix-linux) to control and log privilege escalation from [Ansible](https://docs.ansible.com/ansible/latest/collections/community/general/pbrun_become.html).

> **Comments:**
> **username_0**: Thank you! Hashicorp Vault solution looks cool, I think it could be used for CI/CD as well - just copy the password to a file and read it during playbook execution. Since it's one-time only, no issue to just leave this alone :D   Very cool solutions, haven't seen them anywhere during my research. Quite complicated I must say as well. I think I'm going to try AWX for now, since it has vault support "out of the box" and allows remote execution. I'll use only one key but it will be much easier to lock down. Thanks again for linking these solutions!  
> **username_1**: No problem! AWX has bugs but is a great tool, currently using it extensively.  

---

