managing-configuration

Define an inventory of target hosts, then write a playbook with tasks using state-based modules like apt and service. Run it with ansible-playbook -i inventory site.yml, testing first with --check --diff for a dry run.

Use state-based modules (apt, service, file) with state parameters like present or started instead of command or shell. Verify idempotency by running the playbook twice or using molecule idempotence; the second run should report zero changes.

Use ansible-vault for small teams with simple encryption needs since it is built-in and free. Choose HashiCorp Vault when you need dynamic credentials, audit logging, automated rotation, or compliance with SOC2 or PCI-DSS requirements.

Use Terraform to provision cloud resources like EC2 instances and load balancers, then use Ansible to configure the OS, install packages, and deploy applications. Terraform outputs can feed directly into Ansible inventory for a combined workflow.

Install the amazon.aws collection, then create an inventory file using the aws_ec2 plugin with regions, tag filters, and keyed_groups. Verify it with ansible-inventory -i aws_ec2.yml --list before running playbooks against discovered hosts.

Handlers only run when the notifying task reports a changed status, and they execute at the end of the playbook by default. Check that the task actually changed, that handler names match exactly, or use meta: flush_handlers to force earlier execution.