Compliance with Ansible

Compliance in the context of Ansible refers to the ability to ensure that systems are configured and maintained in accordance with predefined standards, regulations, and best practices. This lesson will guide you through key concepts, the use of Ansible for compliance, and best practices for maintaining compliance in your infrastructure.

• Configuration Management: The process of managing configuration settings and policies for systems.
• Compliance Standards: Regulatory requirements such as ISO 27001, NIST, PCI-DSS, etc.
• Idempotency: Ensuring that applying the same Ansible playbook multiple times has the same effect as applying it once.
• Playbooks: YAML files that define a series of tasks to be executed on hosts.

Using Ansible playbooks is a powerful way to enforce compliance. Below is a sample playbook that ensures a system complies with certain security policies:

---
- name: Ensure compliance with security policies
  hosts: all
  tasks:
    - name: Ensure the firewall is enabled
      firewalld:
        state: started
        permanent: true
        immediate: yes

    - name: Ensure SSH protocol is set to 2
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^Protocol'
        line: 'Protocol 2'
      notify: Restart sshd

  handlers:
    - name: Restart sshd
      service:
        name: sshd
        state: restarted

This playbook ensures that the firewall is enabled and that SSH is configured to use protocol 2, a compliance requirement for many security standards.

• Use version control for your playbooks to track changes and ensure accountability.
• Regularly audit your systems to identify compliance gaps.
• Utilize Ansible roles to modularize your playbooks for better organization and reuse.
• Test your playbooks in a staging environment before applying them to production systems.
• Document your compliance requirements and link them to specific tasks in your playbooks.

graph TD;
                A[Start] --> B{Compliance Check}
                B -->|Yes| C[Apply Playbook]
                B -->|No| D[Identify Gaps]
                D --> E[Update Playbook]
                E --> C
                C --> F[End]