Question

A DevSecOps team uses Ansible to orchestrate configuration of thousands of Linux hosts. During a security review, an engineer discovers that database passwords and API tokens are stored in cleartext within playbook group_vars files committed to the shared Git repository, and that playbooks run under a single privileged service account with unrestricted SSH access to all managed nodes. Which combination of changes MOST effectively hardens the automation platform against secret exposure and blast-radius escalation?

Accepted Answer

Encrypt the sensitive variables with Ansible Vault backed by a secret retrieved at runtime from an external secrets manager, and scope the control node's credentials using just-in-time, task-limited SSH access per host group

Answer

Move the group_vars files to a private repository, enable branch protection, and rotate the shared service account password every 30 days

Answer

Base64-encode the passwords and tokens in the playbooks and restrict repository read access to the DevSecOps team members only

Answer

Replace the SSH key on the control node with a longer RSA key and enable verbose logging on all managed nodes to detect misuse