Implementing Zero Trust with Ansible Automation Platform
In traditional network models, a firewall protects the edge, and anything “inside” is implicitly trusted — a system that critically fails when attackers breach the perimeter, insiders go rogue, or workloads span distributed clouds. Zero Trust flips this model, dictating that every single request — whether from a person, an application, or an automation job — must prove it should be allowed through strong identity management, explicit policy enforcement, and continuous verification.
This workshop provides hands-on experience building a NIST SP 800-207 compliant environment where Red Hat Ansible Automation Platform sits at the center of the architecture. By integrating various infrastructure and security tools — such as Open Policy Agent (OPA) for policy decisions, HashiCorp Vault for secrets, and Splunk for threat signaling — Ansible Automation Platform acts as the unified gateway, ensuring that every operational change passes through identity checks, policy gates, and audit trails.
Key themes explored in the workshop:
- Ansible Automation Platform as the Policy Enforcement Point: By acting as the Policy Enforcement Point (PEP) specified in this NIST standard, Ansible Automation Platform prevents tangles of one-off tool integrations. It ties identity providers, policy engines, secret managers, and SIEMs into a single cohesive platform.
- Policy as Code: Utilizing OPA as the Policy Decision Point (PDP) from NIST, every job is gated at the platform level. This ensures strict adherence to principles like “deny by default” and “least privilege,” stopping unauthorized actions before a playbook even begins.
- Security Posture as Playbooks: The workshop instills the discipline that configurations in a Zero Trust Architecture must be repeatable, auditable, and version-controlled. Every integration is defined as an Ansible Playbook, meaning the playbooks themselves are the verifiable security posture.
- Automated Containment & Dynamic Credentials: Emphasizes “no passwords on disk” approach using short-lived credentials from HashiCorp Vault, alongside Ansible Automation Platform’s Event-Driven Ansible (EDA), which automatically closes the detection-to-containment loop in seconds when threats are detected.
Workshop Resources
| Resource | Link |
|---|---|
| Workshop content and exercises | 🖥️ Google Slides |
| Post-event survey | 📋 Post-event survey |
| Registration page & promotional email copy | 📝 Registration page & promotional email copy |
| Event banners | 🎨 Adobe Express banners |
Target Audience
- Security operations, engineers, and architects
- SysAdmins and ITOps
- Network Architects and operations
- Cloud Architects and operations
- IT Architects
- Platform Engineers
Attendee Prerequisites
- A basic understanding of working with Linux systems
- A basic understanding of Visual Studio Code. [Available for MacOS, Windows and Linux]
- Student has one (1) of the following:
- Student has completed the Ansible Red Hat Enterprise Linux Workshop
- Student has completed the Write your first playbook interactive lab
- Student has completed the Red Hat training course Ansible Basics: Automation Technical Overview
- Attendees must bring/use a laptop with ADMIN rights and the ability to SSH to a lab environment hosted in a public cloud.
- Must bring/use a laptop with Chrome 73+, Firefox 60+, Edge 40+, or Safari 12+ installed.
Presentation Deck
- Google Slides - For Red Hat employees
Lab Options
| Option | Link | Description |
|---|---|---|
| Launch on RHDP | 🚀 Launch Lab | Provision a full lab environment on the Red Hat Demo Platform |
| View Instructions | 📖 View Showroom | Browse the lab instructions and exercises |
Lab provisioner
This lab environment is available via the Red Hat Demo Platform under the Implementing Zero Trust with Ansible Automation Platform catalog item.
Exercises
| Activity | Link |
|---|---|
| Slides: Introduction + Workshop Brief | 🖥️ Google Slides |
| Exercise 1 — Verify ZTA Components and AAP Integration | 🚀 Launch Exercise |
| Exercise 2 — Deploy application with short-lived credentials | 🚀 Launch Exercise |
| Exercise 3 — AAP Policy as Code: platform-gated patching | 🚀 Launch Exercise |
| Exercise 4 — SPIFFE-verified network VLAN management | 🚀 Launch Exercise |
| Exercise 5 — Automated incident response with Splunk and EDA | 🚀 Launch Exercise |
| *Extended security workshop option | |
| Exercise 6 — SSH lockdown and break-glass | 🚀 Launch Exercise |
| Exercise 7 — Wazuh SIEM (optional) | 🚀 Launch Exercise |
Ansible Workshop
This is an official Ansible Workshop
This workshop is maintained by the Red Hat Ansible Technical Marketing Team. Please open an issues on Github
