Ansible AAP — Enterprise Guide

Introduction

Ansible Automation Platform (AAP) is Red Hat's enterprise solution for scaling Ansible across organizations. It provides a web UI, REST API, RBAC, credential management, job scheduling, workflow orchestration, and audit logging — everything CLI Ansible lacks for team and enterprise use.

AAP Components

Component	Purpose
Automation Controller	Web UI + API (formerly Tower)
Automation Hub	Private content repository (roles, collections)
Event-Driven Ansible	React to events automatically
Automation Mesh	Distributed execution across networks
Insights	Analytics and recommendations

AAP vs AWX

Feature	AWX (Open Source)	AAP (Enterprise)
Cost	Free	Subscription
Support	Community	Red Hat
Automation Hub	No	Yes
Automation Mesh	No	Yes
Event-Driven	No	Yes
Insights	No	Yes
Certifications	No	Yes
SLA	No	Yes

AWX is the upstream project. AAP is the supported, enterprise-hardened product.

Key Concepts

Job Templates

A job template wraps a playbook with everything needed to run it:

Playbook — which playbook to run
Inventory — which hosts to target
Credentials — SSH keys, cloud credentials, vault passwords
Extra Variables — runtime parameters
Limit — subset of inventory
Tags — run specific tags
Verbosity — output level

# Equivalent CLI:
ansible-playbook -i inventory deploy.yml \
  --extra-vars "version=2.1.0" \
  --limit webservers \
  --tags deploy \
  -e @vault.yml

Workflows

Chain multiple job templates with conditional logic:

[Update Code] → success → [Run Tests]
                              ↓
                          success → [Deploy Staging]
                                        ↓
                                    success → [Approval Node]
                                                  ↓
                                              approved → [Deploy Production]
                                              denied  → [Notify Team]

Workflow features:

Conditional paths (success/failure/always)
Approval nodes (human gate)
Inventory/credential convergence
Parallel execution branches
Nested workflows

Inventories

Type	Source
Static	Manual host list
Dynamic	AWS, Azure, GCP, VMware, Satellite
Smart	Filter from other inventories
Constructed	Build groups from host facts

Credentials

Centralized, encrypted credential storage:

Type	Examples
Machine	SSH keys, passwords
Cloud	AWS, Azure, GCP, OpenStack
SCM	Git, SVN
Vault	Ansible Vault password
Network	Router/switch credentials
Container	Docker, Kubernetes
Custom	Any credential type

Credentials are never exposed in logs or to users without permission.

RBAC (Role-Based Access Control)

Organization
  └── Teams
       └── Users
            └── Permissions (per resource)

Roles:
- Admin      → Full access
- Execute    → Run job templates
- Read       → View only
- Use        → Use in other resources
- Update     → Modify
- Approve    → Approve workflow nodes

Permission Examples

# Team "Developers" can:
- Execute: deploy-staging template
- Read: production inventory
- Use: staging credentials

# Team "Operations" can:
- Admin: all job templates
- Execute: all templates
- Approve: production deployments

API Usage

# List job templates
curl -s https://aap.example.com/api/v2/job_templates/ \
  -H "Authorization: Bearer $TOKEN" | jq '.results[].name'

# Launch a job
curl -X POST https://aap.example.com/api/v2/job_templates/42/launch/ \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"extra_vars": {"version": "2.1.0"}}'

# Check job status
curl -s https://aap.example.com/api/v2/jobs/123/ \
  -H "Authorization: Bearer $TOKEN" | jq '.status'

Ansible Module for AAP

# Launch job template from playbook
- name: Launch deploy job
  awx.awx.job_launch:
    job_template: "Deploy Application"
    extra_vars:
      version: "{{ app_version }}"
    controller_host: https://aap.example.com
    controller_token: "{{ aap_token }}"
  register: job

- name: Wait for job to complete
  awx.awx.job_wait:
    job_id: "{{ job.id }}"
    controller_host: https://aap.example.com
    controller_token: "{{ aap_token }}"

Event-Driven Ansible (EDA)

React to events automatically:

# rulebook.yml
---
- name: Auto-remediate disk space
  hosts: all
  sources:
    - ansible.eda.alertmanager:
        host: 0.0.0.0
        port: 5000

  rules:
    - name: Disk space alert
      condition: event.alert.labels.alertname == "DiskSpaceLow"
      action:
        run_job_template:
          name: "Cleanup Disk Space"
          organization: "Operations"
          job_args:
            extra_vars:
              target_host: "{{ event.alert.labels.instance }}"

    - name: Service down
      condition: event.alert.labels.alertname == "ServiceDown"
      action:
        run_job_template:
          name: "Restart Service"
          organization: "Operations"

Automation Mesh

Distribute execution across network segments:

     ┌─────────────┐
     │  Controller  │ (Datacenter)
     └──────┬───────┘
            │
    ┌───────┴───────┐
    ▼               ▼
┌────────┐    ┌────────┐
│ Hop    │    │ Hop    │  (Network boundaries)
│ Node   │    │ Node   │
└───┬────┘    └───┬────┘
    │              │
    ▼              ▼
┌────────┐    ┌────────┐
│Execution│   │Execution│ (Target networks)
│ Node   │    │ Node   │
└────────┘    └────────┘

Best Practices

Use Organizations — separate teams and their resources
Use Credentials — never store secrets in playbooks
Use Surveys — let users provide parameters safely
Use Notifications — Slack, email, webhook on job completion
Use Schedules — automate recurring jobs (patching, backups)
Use Workflows — for multi-step processes with approvals
Use Smart Inventories — dynamic host filtering
Use Labels — organize and filter job templates
Audit logs — every action is logged for compliance
API-first — integrate with CI/CD, ITSM, ChatOps

Conclusion

AAP transforms Ansible from a CLI tool into an enterprise automation platform. Automation Controller provides the web UI, API, RBAC, and audit logging. Automation Hub provides a private content repository. EDA enables event-driven remediation. Automation Mesh enables execution across network segments. For teams, AAP adds the governance, security, and collaboration features that CLI Ansible can't provide. Start with AWX to learn the concepts, then move to AAP for production enterprise use.