Ansible for secure automation

Ansible touches everything with root, which makes it either your best control or your worst incident. This is the security course that sits on top of the Ansible fundamentals: keep secrets out of the repo and out of the logs, scope escalation to the tasks that need it, bound the blast radius of every run, guard the destructive tasks, treat Galaxy content as the third-party code it is, and leave an audit trail somebody can actually read afterwards.