Ansible Zero to Hero: Policy as Code — DevSecOps Implementation Project

Welcome to the comprehensive study notes for Episode 10 of the Ansible Zero to Hero series. This guide explores the principles of Policy as Code (PaC) within modern DevSecOps pipelines, contrasting manual compliance burdens with automated, declarative enforcement using Ansible and AWS.

1. What is Policy as Code (PaC)?

In the world of IT and Software Development Life Cycles (SDLC), policies are established rules designed to guarantee security, governance, and regulatory compliance across organizational infrastructure.

• Definition: Policy as Code is the practice of writing, managing, and enforcing security and compliance rules programmatically rather than manually checking and updating cloud resources via web consoles.
• The Non-IT Analog (The Badge Rule): Just as a university or corporate office enforces a strict physical security policy requiring every individual to wear an identification card to enter the premises, IT infrastructures enforce non-negotiable operational rules (e.g., encryption standards, access controls, backup retention).

Real-World Policy Scenarios in AWS

Organizations frequently encounter mandates that apply universally across disparate development teams, test engineers, and automated CI/CD pipelines:

• S3 Storage Security: Every S3 bucket must have bucket versioning enabled and must never be exposed publicly.
• Compute Auditing: Every EC2 instance must be attached to a specific instance profile linked to a security baseline.
• Identity Governance: Every IAM user must adhere to strict permission boundaries and multi-factor authentication (MFA) requirements.

2. Why Do We Need Policy as Code?

As organizations scale, managing infrastructure manually becomes unsustainable.

The Problem of Scale & Drift

• Human Oversight: When an organization manages hundreds of S3 buckets, EC2 instances, and IAM users, manual auditing via the AWS Console is impossible to maintain consistently.
• Configuration Drift: Even if resources are initially deployed securely, manual changes or unmanaged out-of-band updates can introduce security gaps over time.
• Security Compromises: A single developer creating a misconfigured public S3 bucket containing application logs or sensitive metadata can expose an entire enterprise to data breaches.

Why Ansible is Ideal for Policy as Code

While languages like Python (via the boto3 SDK) or Terraform can implement PaC, Ansible offers distinct structural advantages for DevSecOps teams:

• Simplicity & Readability: Playbooks are written in human-readable YAML, making them accessible to team members who may not be full-time software engineers.
• Idempotency: Ansible modules are designed to be idempotent—running the same playbook multiple times results in the desired state without making redundant or destructive changes if the policy is already satisfied.
• Agentless API Interaction: Ansible connects directly to cloud provider APIs (e.g., AWS S3 APIs) without requiring software agents to be installed on target cloud resources.

3. Architecture & Prerequisites for AWS Integration

Before executing an Ansible playbook against AWS, you must establish proper authentication and tooling on your control node (local machine or CI/CD runner).

Prerequisites Checklist

1. AWS Account: Administrative or scoped access to create and manage test buckets.
2. AWS CLI Configured: Local credentials configured via aws configure.
3. Python & Boto3: Python runtime with the AWS SDK (boto3) installed to handle underlying API requests.
4. Ansible AWS Collection: The specific collection (amazon.aws) installed via Ansible Galaxy.

Step-by-Step Environment Setup

# 1. Configure AWS CLI credentials on your control machine
aws configure
# Enter AWS Access Key ID: [YOUR_ACCESS_KEY]
# Enter AWS Secret Access Key: [YOUR_SECRET_KEY]
# Default region name: [e.g., us-east-1]
# Default output format: [json]

# 2. Verify AWS access by listing S3 buckets
aws s3 ls

# 3. Install the required Python Boto3 library
pip install boto3

# 4. Install the Ansible AWS Collection
ansible-galaxy collection install amazon.aws

4. Understanding Ansible Connection Mechanics with Cloud APIs

A common point of confusion for beginners is how Ansible connects to cloud providers compared to traditional virtual machines.

5. Designing the Policy Enforcement Playbook (Step-by-Step)

To enforce bucket versioning across all S3 buckets in an AWS account, our Ansible playbook follows a robust two-step pattern:

1. Discovery Phase: Query AWS to list all existing S3 buckets and register the output into a variable array.
2. Enforcement Phase (Looping): Iterate over the registered array, extracting each bucket's name, and apply the versioning policy.

Complete Ansible Playbook: s3_versioning.yaml

---
- name: Enforce S3 bucket versioning on AWS
  hosts: localhost
  gather_facts: false
  
  tasks:
    - name: Step 1 - List all S3 buckets in the AWS account
      amazon.aws.s3_bucket_info:
        # Authentication automatically pulled from AWS CLI configuration (~/.aws/credentials)
      register: result

    - name: Step 2 - Enable versioning on each discovered S3 bucket
      amazon.aws.s3_bucket:
        name: "{{ item.name }}"
        versioning: true
      loop: "{{ result.buckets }}"
      loop_control:
        loop_var: item

6. Code Walkthrough & Variable Breakdown

• hosts: localhost: Specifies that the playbook executes locally on the control node rather than targeting remote servers over SSH.
• gather_facts: false: Disables gathering local machine facts (OS version, IP addresses, etc.), speeding up playbook execution since we are only interacting with cloud APIs.
• amazon.aws.s3_bucket_info: An AWS collection module that queries S3 metadata.
• register: result: Captures the entire JSON response from the AWS API and stores it in a variable named result.
• loop: "{{ result.buckets }}": Inspects the registered variable. The API response nests the bucket array inside a dictionary key called buckets. Therefore, we iterate over result.buckets (containing elements item[0], item[1], etc.).
• name: "{{ item.name }}": Extracts the specific string identifier for each iteration (e.g., mega-metric-gillium) so the s3_bucket module targets the exact resource.
• versioning: true: Enforces the required compliance state. (Note: Ansible accepts boolean values true/false or string equivalents depending on the specific module version, but standard YAML booleans are preferred).

7. Execution and Verification Workflow

Run the Ansible playbook from your terminal within the directory containing your YAML file:

ansible-playbook s3_versioning.yaml

Execution Output Sample

AWS Console Verification

1. Navigate to the Amazon S3 Console.
2. Click into any managed bucket (e.g., middleware-logging).
3. Select the Properties tab.
4. Verify that Bucket Versioning is now successfully updated to Enabled.

8. Summary and Key Takeaways

• Policy as Code (PaC) replaces manual, error-prone operational reviews with automated, programmatic security and compliance rules.
• Real-World Relevance: Just as institutions enforce ID card policies for physical security, cloud environments require automated policies (like S3 versioning and encryption) to safeguard enterprise data.
• Ansible Advantage: Ansible provides a lightweight, agentless, and readable YAML-based framework well-suited for orchestrating cloud API configurations.
• API vs. Server Communication: Managing cloud resources via Ansible requires cloud SDKs (like Python's boto3) and API keys, bypassing the need for SSH passwordless authentication.
• Two-Step Automation Pattern: Effective cloud policy playbooks utilize a Discovery Phase (_info modules to gather assets into arrays) followed by an Enforcement Phase (loop constructs to apply state idempotently).
• Idempotency in Cloud Enforcement: Running Ansible playbooks repeatedly ensures that compliance drift is automatically corrected without breaking existing configurations.
• Extensibility: The same PaC pattern can be extended beyond S3 storage to enforce compliance across EC2 instance profiles, IAM security policies, and network security groups.