v1.0 for Steampipe, Powerpipe, Flowpipe, 116 plugins, and 44 mods →

turbot/ansible

Overview

4Tables

Versions

GitHub

steampipe plugin install ansiblesteampipe plugin install ansible

Ansible + Steampipe

Steampipe is an open-source zero-ETL engine to instantly query cloud APIs using SQL.

Ansible offers open-source automation that is simple, flexible, and powerful.

The Ansible plugin makes it simpler to query the configured Ansible playbook files, and the various tasks defined in it. Apart from scanning the playbook files, the plugin also supports scanning the Ansible inventory files from different sources.

List all playbooks that use privilege escalation:

select
  name,
  hosts,
  jsonb_pretty(tasks) as tasks
from
  ansible_playbook
where
  become;

+----------+-------------+----------------------------------------------------------+
| name     | hosts       | tasks                                                    |
+----------+-------------+----------------------------------------------------------+
| Playbook | web_servers | [                                                        |
|          |             |     {                                                    |
|          |             |         "yum": {                                         |
|          |             |             "name": "httpd",                             |
|          |             |             "state": "latest"                            |
|          |             |         },                                               |
|          |             |         "name": "ensure apache is at the latest version" |
|          |             |     },                                                   |
|          |             |     {                                                    |
|          |             |         "name": "ensure apache is running",              |
|          |             |         "service": {                                     |
|          |             |             "name": "httpd",                             |
|          |             |             "state": "started"                           |
|          |             |         }                                                |
|          |             |     }                                                    |
|          |             | ]                                                        |
+----------+-------------+----------------------------------------------------------+

Documentation

Table definitions & examples →

Quick start

Install

Download and install the latest Ansible plugin:

steampipe plugin install ansible

Credentials

No credentials are required.

Configuration

Installing the latest ansible plugin will create a config file (~/.steampipe/config/ansible.spc) with a single connection named ansible:

Configure your file paths in ~/.steampipe/config/ansible.spc:

connection "ansible" {
  plugin = "ansible"

  # The plugin supports parsing both Ansible playbook files as well as inventory files.
  # For example:
  #  - To parse the Ansible playbook files, use `playbook_file_paths` argument to configure it.
  #  - Similarly, to parse the Ansible inventory files, use `inventory_file_paths`.

  # The above paths can be configured with a local directory, a remote Git repository URL, or an S3 bucket URL
  # Wildcard based searches are supported, including recursive searches
  # Local paths are resolved relative to the current working directory (CWD)

  # For example:
  #  - "*.yml" matches all Ansible playbook files in the CWD
  #  - "**/*.yml" matches all Ansible playbook files in the CWD and all sub-directories
  #  - "../*.yml" matches all Ansible playbook files in the CWD's parent directory
  #  - "steampipe*.yml" matches all Ansible playbook files starting with "steampipe" in the CWD
  #  - "/path/to/dir/*.yml" matches all Ansible playbook files in a specific directory
  #  - "/path/to/dir/main.yml" matches a specific file

  # If paths includes "*", all files (including non-Ansible playbook files) in
  # the CWD will be matched, which may cause errors if incompatible file types exist

  # Defaults to CWD
  playbook_file_paths  = [ "*.yml", "*.yaml" ]
  inventory_file_paths = [ "/etc/ansible/hosts", "~/.ansible/hosts" ]
}

Configuring File Paths

The plugin supports scanning both Ansible playbook files and the inventory files. For scanning the files, configure the plugin config file with the desired file paths. For example:

For scanning the Ansible playbook files, use playbook_file_paths argument to configure it.
For scanning the Ansible inventory files, use inventory_file_paths argument to configure it.

Both playbook_file_paths and inventory_file_paths config arguments are flexible and can search for Ansible playbook files from various sources (e.g., Local files, Git, S3 etc.).

Paths may include wildcards and support ** for recursive matching. For example:

connection "ansible" {
  plugin = "ansible"

  playbook_file_paths = [
    "*.yml",
    "~/*.yaml",
    "github.com/ansible-community/molecule//playbooks//*.yaml",
    "s3::https://bucket.s3.us-east-1.amazonaws.com/test_folder//*.yaml"
  ]

  inventory_file_paths = ["*.ini", "~/*.ini"]
}

Note: If any path matches on * with .yml or .yaml, all files (including non-Ansible playbook files) in the directory will be matched, which may cause errors if incompatible file types exist.

Configuring Local File Paths

You can define a list of local directory paths to search for Ansible playbook files. Paths are resolved relative to the current working directory. For example:

*.yml or *.yaml matches all Ansible playbook files in the CWD.
**/*.yml or **/*.yaml matches all Ansible playbook files in the CWD and all sub-directories.
../*.yml or ../*.yaml matches all Ansible playbook files in the CWD's parent directory.
steampipe*.yml or steampipe*.yaml matches all Ansible playbook files starting with "steampipe" in the CWD.
/path/to/dir/*.yml or /path/to/dir/*.yaml matches all Ansible playbook files in a specific directory. For example:
- ~/*.yml or ~/*.yaml matches all Ansible playbook files in the home directory.
- ~/**/*.yml or ~/**/*.yaml matches all Ansible playbook files recursively in the home directory.
/path/to/dir/main.yml or /path/to/dir/main.yaml matches a specific file.

connection "ansible" {
  plugin = "ansible"

  playbook_file_paths = [ "*.yml", "*.yaml", "/path/to/dir/playbook.yaml" ]
}

Configuring Remote Git Repository URLs

You can also configure paths with any Git remote repository URLs, e.g., GitHub, BitBucket, GitLab. The plugin will then attempt to retrieve any Ansible playbook files from the remote repositories.

For example:

github.com/ansible-community/molecule//playbooks//*.yaml matches all top-level Ansible playbook files in the specified repository.
github.com/ansible-community/molecule//playbooks//**/*.yaml matches all Ansible playbook files in the specified repository and all subdirectories.

You can specify a subdirectory after a double-slash (//) if you want to download only a specific subdirectory from a downloaded directory.

connection "ansible" {
  plugin = "ansible"

  playbook_file_paths = ["github.com/ansible-community/molecule//playbooks//*.yaml"]
}

Similarly, you can define a list of GitLab and BitBucket URLs to search for Ansible playbook files.

Configuring S3 URLs

You can also query all Ansible playbook files stored inside an S3 bucket (public or private) using the bucket URL.

Accessing a Private Bucket

In order to access your files in a private S3 bucket, you will need to configure your credentials. You can use your configured AWS profile from local ~/.aws/config, or pass the credentials using the standard AWS environment variables, e.g., AWS_PROFILE, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION.

We recommend using AWS profiles for authentication.

Note: Make sure that region is configured in the config. If not set in the config, region will be fetched from the standard environment variable AWS_REGION.

You can also authenticate your request by setting the AWS profile and region in paths. For example:

connection "ansible" {
  plugin = "ansible"

  playbook_file_paths = [
    "s3::https://bucket-2.s3.us-east-1.amazonaws.com//*.json?aws_profile=<AWS_PROFILE>",
    "s3::https://bucket-2.s3.us-east-1.amazonaws.com/test_folder//*.yaml?aws_profile=<AWS_PROFILE>"
  ]
}

Note:

In order to access the bucket, the IAM user or role will require the following IAM permissions:

s3:ListBucket
s3:GetObject
s3:GetObjectVersion

If the bucket is in another AWS account, the bucket policy will need to grant access to your user or role. For example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadBucketObject",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:user/YOUR_USER"
      },
      "Action": ["s3:ListBucket", "s3:GetObject", "s3:GetObjectVersion"],
      "Resource": ["arn:aws:s3:::test-bucket1", "arn:aws:s3:::test-bucket1/*"]
    }
  ]
}

Accessing a Public Bucket

Public access granted to buckets and objects through ACLs and bucket policies allows any user access to data in the bucket. We do not recommend making S3 buckets public, but if there are specific objects you'd like to make public, please see How can I grant public read access to some objects in my Amazon S3 bucket?.

You can query any public S3 bucket directly using the URL without passing credentials. For example:

connection "ansible" {
  plugin = "ansible"

  playbook_file_paths = [
    "s3::https://bucket-1.s3.us-east-1.amazonaws.com/test_folder//*.json",
    "s3::https://bucket-2.s3.us-east-1.amazonaws.com/test_folder//**/*.yaml"
  ]
}

Postgres FDW

This plugin is available as a native Postgres FDW. Unlike Steampipe CLI, which ships with an embedded Postgres server instance, the Postgres FDW can be installed in any supported Postgres database version.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_postgres_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/postgres.sh)" -- ansible

The installer will prompt you for the plugin name and version, download and install the appropriate files for your OS, system architecture, and Postgres version.

To configure the Postgres FDW, you will create an extension, foreign server, and schema and import the foreign schema.

CREATE EXTENSION IF NOT EXISTS steampipe_postgres_ansible;
CREATE SERVER steampipe_ansible FOREIGN DATA WRAPPER steampipe_postgres_ansible OPTIONS (config '<your_config>');
CREATE SCHEMA ansible;
IMPORT FOREIGN SCHEMA ansible FROM SERVER steampipe_ansible INTO ansible;

SQLite Extension

This plugin is available as a SQLite Extension, making the tables available as SQLite virtual tables.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_sqlite_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/sqlite.sh)" -- ansible

The installer will prompt you for the plugin name, version, and destination directory. It will then determine the OS and system architecture, and it will download and install the appropriate package.

To configure the SQLite extension, load the extension module and then run the steampipe_configure_ansible function to configure it with plugin-specific options.

$ sqlite3
sqlite> .load ./steampipe_sqlite_extension_ansible.so
sqlite> select steampipe_configure_ansible('<your_config>');

Export

This plugin is available as a standalone Export CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- ansible

You can pass the configuration to the command with the --config argument:

steampipe_export_ansible --config '<your_config>' <table_name>