Ansible for AI Security — Automate AI Platform Security

Introduction

As organizations deploy AI at scale in 2026, AI security has become its own platform category. Gartner lists AI security platforms as a top strategic trend. Ansible automates the security hardening of AI infrastructure: model access controls, GPU isolation, prompt injection defenses, data pipeline security, and compliance scanning.

AI Security Threat Surface

Threat	Risk	Ansible Mitigation
Model theft	Stolen weights/IP	File permissions, network isolation
Prompt injection	Unauthorized actions	WAF rules, input validation
Data poisoning	Corrupted training data	Pipeline integrity checks
GPU side-channel	Cross-tenant data leak	GPU isolation, MIG config
Model supply chain	Malicious model files	Hash verification, scanning
Inference API abuse	DDoS, cost explosion	Rate limiting, authentication

Secure Model Storage

- name: Secure AI model storage
  hosts: model_servers
  become: true
  vars:
    model_dir: /opt/models
    model_user: ml-inference
    model_group: ml-team

  tasks:
    - name: Create dedicated model service account
      ansible.builtin.user:
        name: "{{ model_user }}"
        system: true
        shell: /usr/sbin/nologin
        groups: "{{ model_group }}"

    - name: Set strict model directory permissions
      ansible.builtin.file:
        path: "{{ model_dir }}"
        state: directory
        owner: "{{ model_user }}"
        group: "{{ model_group }}"
        mode: "0750"
        recurse: true

    - name: Configure immutable model files
      ansible.builtin.command: "chattr +i {{ item }}"
      loop: "{{ model_files }}"
      when: lock_models | default(false)

    - name: Set up model integrity monitoring
      ansible.builtin.template:
        src: aide-models.conf.j2
        dest: /etc/aide/aide.conf.d/models.conf
      notify: Reinitialize AIDE

    - name: Verify model checksums
      ansible.builtin.stat:
        path: "{{ item.path }}"
        checksum_algorithm: sha256
      loop: "{{ expected_models }}"
      register: model_checksums

    - name: Alert on model tampering
      ansible.builtin.fail:
        msg: "Model tampered: {{ item.item.path }} expected {{ item.item.sha256 }} got {{ item.stat.checksum }}"
      loop: "{{ model_checksums.results }}"
      when: item.stat.checksum != item.item.sha256

GPU Isolation (NVIDIA MIG)

- name: Configure GPU isolation for multi-tenant AI
  hosts: gpu_servers
  become: true
  tasks:
    - name: Enable MIG mode on A100/H100
      ansible.builtin.command: nvidia-smi -i {{ item }} -mig 1
      loop: "{{ range(gpu_count | int) | list }}"
      register: mig_result
      changed_when: "'Enabled' in mig_result.stdout"

    - name: Create GPU instances (isolate tenants)
      ansible.builtin.shell: |
        # Create 3 isolated GPU instances on GPU 0
        nvidia-smi mig -i 0 -cgi 19,19,19 -C
      args:
        creates: /proc/driver/nvidia/gpu-instances

    - name: Verify MIG configuration
      ansible.builtin.command: nvidia-smi mig -lgi
      register: mig_status
      changed_when: false

    - name: Display GPU instances
      ansible.builtin.debug:
        msg: "{{ mig_status.stdout_lines }}"

API Gateway Security

- name: Secure AI inference API
  hosts: api_gateway
  become: true
  tasks:
    - name: Deploy rate limiting for inference API
      ansible.builtin.template:
        src: nginx-ai-security.conf.j2
        dest: /etc/nginx/conf.d/ai-security.conf
      notify: Reload Nginx

    - name: Configure WAF rules for prompt injection
      ansible.builtin.copy:
        content: |
          # Block common prompt injection patterns
          SecRule ARGS "@rx (?i)(ignore previous|disregard|forget your|you are now|system prompt)" \
            "id:100001,phase:2,deny,status:403,msg:'Prompt injection attempt'"

          SecRule ARGS "@rx (?i)({{.*}}|<script|javascript:)" \
            "id:100002,phase:2,deny,status:403,msg:'Template injection attempt'"

          # Limit input length
          SecRule ARGS_COMBINED_SIZE "@gt 10000" \
            "id:100003,phase:2,deny,status:413,msg:'Input too large'"
        dest: /etc/modsecurity/rules/ai-protection.conf
      notify: Reload Nginx

    - name: Set up API authentication
      ansible.builtin.template:
        src: ai-api-auth.conf.j2
        dest: /etc/nginx/conf.d/ai-auth.conf
      no_log: true
      notify: Reload Nginx

Nginx template:

{# templates/nginx-ai-security.conf.j2 #}
# Rate limiting zones
limit_req_zone $binary_remote_addr zone=inference:10m rate=10r/s;
limit_req_zone $http_x_api_key zone=per_key:10m rate=100r/s;

# Connection limits
limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    listen 443 ssl;
    server_name api.{{ domain }};

    # Rate limit inference endpoint
    location /v1/chat/completions {
        limit_req zone=inference burst=20 nodelay;
        limit_req zone=per_key burst=50 nodelay;
        limit_conn addr 10;

        # Request size limit (prevent large prompt attacks)
        client_max_body_size 1m;

        # Timeout for long-running inference
        proxy_read_timeout 120s;

        proxy_pass http://inference_backend;
    }
}

AI Data Pipeline Security

- name: Secure AI data pipelines
  hosts: data_servers
  become: true
  tasks:
    - name: Encrypt training data at rest
      community.crypto.luks_device:
        device: /dev/sdb
        state: present
        keyfile: /root/.keys/training-data.key
      no_log: true

    - name: Mount encrypted training data
      ansible.posix.mount:
        path: /data/training
        src: /dev/mapper/training-data
        fstype: ext4
        state: mounted

    - name: Set training data permissions
      ansible.builtin.file:
        path: /data/training
        owner: ml-pipeline
        group: ml-team
        mode: "0750"
        recurse: true

    - name: Configure data access audit logging
      ansible.builtin.template:
        src: auditd-ml-data.rules.j2
        dest: /etc/audit/rules.d/ml-data.rules
      notify: Restart auditd

    - name: Enable data lineage tracking
      ansible.builtin.cron:
        name: "ML data integrity check"
        hour: "2"
        minute: "0"
        job: "sha256sum /data/training/**/*.parquet > /var/log/ml-data-hashes.log 2>&1"

Model Supply Chain Security

- name: Secure model downloads
  hosts: model_servers
  become: true
  tasks:
    - name: Configure Hugging Face model scanning
      ansible.builtin.pip:
        name:
          - huggingface_hub
          - safety-checker
        virtualenv: /opt/ml-security/venv

    - name: Scan downloaded models for malicious code
      ansible.builtin.shell: |
        source /opt/ml-security/venv/bin/activate
        python -c "
        from huggingface_hub import scan_cache_dir
        import json
        cache = scan_cache_dir()
        for repo in cache.repos:
            print(json.dumps({'repo': repo.repo_id, 'size': repo.size_on_disk}))
        "
      register: model_scan
      changed_when: false

    - name: Block pickle-based models (security risk)
      ansible.builtin.copy:
        content: |
          # Reject unsafe serialization formats
          SAFETENSORS_ONLY=1
          TRANSFORMERS_NO_PICKLE=1
        dest: /etc/environment.d/ml-security.conf

Compliance Scanning

- name: AI compliance audit
  hosts: all
  become: true
  tasks:
    - name: Check for unencrypted model files
      ansible.builtin.find:
        paths: [/opt/models, /data/models]
        recurse: true
        size: "+100m"
      register: large_models

    - name: Verify model access controls
      ansible.builtin.stat:
        path: "{{ item.path }}"
      loop: "{{ large_models.files }}"
      register: model_perms

    - name: Flag overly permissive model files
      ansible.builtin.debug:
        msg: "⚠️ {{ item.item.path }} is world-readable ({{ item.stat.mode }})"
      loop: "{{ model_perms.results }}"
      when: item.stat.mode is match('.*[4567]$')

    - name: Generate AI security compliance report
      ansible.builtin.template:
        src: ai-compliance-report.j2
        dest: "/tmp/ai-security-{{ inventory_hostname }}-{{ ansible_date_time.date }}.json"
      delegate_to: localhost

Conclusion

AI security in 2026 requires automating six layers: model storage security (permissions, integrity), GPU isolation (MIG), API gateway protection (rate limiting, WAF for prompt injection), data pipeline encryption (LUKS, audit trails), model supply chain security (scanning, SafeTensors-only), and compliance validation. Ansible handles all of these as code — repeatable, auditable, and enforceable across your entire AI infrastructure. The organizations that treat AI security as automation (not checklists) will be the ones that scale safely.