Implement Ansible AWX Tower for enterprise automation workflows with RBAC and inventory management

Update system packages

Start by updating your package manager and installing essential dependencies for Docker and AWX.

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget git python3-pip python3-venv docker.io docker-compose-plugin

sudo dnf update -y
sudo dnf install -y curl wget git python3-pip python3-venv docker docker-compose-plugin

Configure Docker service

Enable Docker service and add your user to the docker group for container management.

sudo systemctl enable --now docker
sudo usermod -aG docker $USER
newgrp docker

Create AWX installation directory

Set up a dedicated directory structure for AWX configuration and persistent data storage.

sudo mkdir -p /opt/awx
sudo mkdir -p /opt/awx/data/projects
sudo mkdir -p /opt/awx/data/inventories
sudo chown -R $USER:$USER /opt/awx
cd /opt/awx

Download AWX Operator

Clone the official AWX Operator repository which provides Docker Compose deployment templates.

git clone https://github.com/ansible/awx-operator.git
cd awx-operator

Create AWX Docker Compose configuration

Generate the main Docker Compose file with PostgreSQL database, Redis cache, and AWX web service containers.

version: '3.8'

services:
  postgres:
    image: postgres:15
    container_name: awx-postgres
    environment:
      POSTGRES_DB: awx
      POSTGRES_USER: awx
      POSTGRES_PASSWORD: awxpassword123
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data/pgdata
    networks:
      - awx-network
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: awx-redis
    command: redis-server --requirepass redispassword123
    networks:
      - awx-network
    restart: unless-stopped

  awx-web:
    image: quay.io/ansible/awx:24.6.1
    container_name: awx-web
    hostname: awx-web
    user: root
    environment:
      AWX_ADMIN_USER: admin
      AWX_ADMIN_PASSWORD: adminpassword123
      DATABASE_USER: awx
      DATABASE_PASSWORD: awxpassword123
      DATABASE_NAME: awx
      DATABASE_HOST: postgres
      DATABASE_PORT: 5432
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: redispassword123
      SECRET_KEY: awxsecretkey12345678901234567890
    volumes:
      - /opt/awx/data/projects:/var/lib/awx/projects
      - /opt/awx/data/inventories:/var/lib/awx/inventories
      - awx_data:/var/lib/awx
    ports:
      - "8080:8052"
    depends_on:
      - postgres
      - redis
    networks:
      - awx-network
    restart: unless-stopped

  awx-task:
    image: quay.io/ansible/awx:24.6.1
    container_name: awx-task
    hostname: awx-task
    user: root
    environment:
      DATABASE_USER: awx
      DATABASE_PASSWORD: awxpassword123
      DATABASE_NAME: awx
      DATABASE_HOST: postgres
      DATABASE_PORT: 5432
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: redispassword123
      SECRET_KEY: awxsecretkey12345678901234567890
      AWX_SKIP_MIGRATIONS: false
    volumes:
      - /opt/awx/data/projects:/var/lib/awx/projects
      - /opt/awx/data/inventories:/var/lib/awx/inventories
      - awx_data:/var/lib/awx
    depends_on:
      - postgres
      - redis
    networks:
      - awx-network
    restart: unless-stopped
    command: ["/usr/bin/launch_awx_task.sh"]

volumes:
  postgres_data:
  awx_data:

networks:
  awx-network:
    driver: bridge

Deploy AWX containers

Start all AWX services and wait for the database initialization to complete.

docker compose up -d
docker compose logs -f awx-task

Configure firewall access

Open port 8080 for AWX web interface access while maintaining security.

sudo ufw allow 8080/tcp
sudo ufw reload

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

Access AWX web interface

Navigate to the AWX interface and complete initial login with the admin credentials.

echo "AWX URL: http://$(hostname -I | awk '{print $1}'):8080"
echo "Username: admin"
echo "Password: adminpassword123"

Create organizational structure

Set up organizations to separate different business units or environments with isolated access controls.

In the AWX web interface:

1. Navigate to Access → Organizations
2. Click Add to create a new organization
3. Enter organization details:

Name: Production Environment
Description: Production infrastructure automation
Default Execution Environment: AWX EE (latest)
Max Hosts: 500

Repeat for additional organizations like "Staging Environment" and "Development Environment".

Configure user roles and permissions

Create role-based access control with granular permissions for different user types.

Create teams with specific roles:

# Infrastructure Team
Name: Infrastructure Admins
Organization: Production Environment
Permissions: Admin on all resources

Application Team  
Name: Application Developers
Organization: Development Environment
Permissions: Execute on job templates, Read on inventories

Operations Team
Name: Operations Engineers
Organization: Production Environment
Permissions: Execute on job templates, Admin on credentials

Set up credential management

Configure secure credential storage for SSH keys, cloud providers, and vault integration.

Navigate to Resources → Credentials and create:

Name: Production SSH Key
Credential Type: Machine
Username: ansible
SSH Private Key: [paste your private key]
Privilege Escalation Method: sudo
Privilege Escalation Username: root

Name: AWS Production
Credential Type: Amazon Web Services
Access Key: AKIA...
Secret Key: [your secret key]
STS Token: [optional]

Set up AWS dynamic inventory

Configure automatic host discovery from AWS EC2 instances with dynamic grouping.

Navigate to Resources → Inventories → Add:

Name: AWS Production Inventory
Organization: Production Environment
Description: Dynamic EC2 instance discovery

Add inventory source:

Name: AWS EC2 Source
Source: Amazon EC2
Credential: AWS Production
Regions: us-east-1,us-west-2
Instance Filters: tag:Environment=production
Update Options:
  - Overwrite
  - Overwrite Variables
  - Update on Launch
Cache Timeout: 3600

Configure inventory grouping variables

Set up host and group variables for dynamic inventory categorization and configuration.

# Web Servers Group Variables
ansible_user: ubuntu
ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
web_server_port: 80
nginx_worker_processes: auto

Database Servers Group Variables  
ansible_user: ubuntu
db_port: 5432
postgresql_version: 15
max_connections: 200

Application Servers Group Variables
ansible_user: ubuntu
app_env: production
java_heap_size: 2g
tomcat_version: 10

Set up Azure and GCP inventory sources

Add additional cloud provider inventory sources for multi-cloud environments.

Name: Azure Production Source
Source: Microsoft Azure Resource Manager
Credential: Azure Service Principal
Subscription ID: your-subscription-id
Resource Groups: production-rg,staging-rg
Update Options:
  - Overwrite
  - Update on Launch

Create project for playbooks

Set up a Git-based project to store and version control your Ansible playbooks.

Navigate to Resources → Projects → Add:

Name: Infrastructure Playbooks
Organization: Production Environment
SCM Type: Git
SCM URL: https://github.com/your-org/ansible-playbooks.git
SCM Branch/Tag/Commit: main
Credential: GitHub Token
Update Options:
  - Clean
  - Delete on Update
  - Update Revision on Launch
Cache Timeout: 300

Create job templates

Configure reusable job templates for common automation tasks with standardized parameters.

Name: Deploy Web Server
Job Type: Run
Inventory: AWS Production Inventory
Project: Infrastructure Playbooks
Playbook: playbooks/deploy-webserver.yml
Credential: Production SSH Key
Limit: tag_Role_webserver
Options:
  - Prompt on Launch (Extra Variables)
  - Enable Concurrent Jobs
  - Use Fact Storage
Timeout: 1800
Forks: 10

Build workflow templates

Create complex multi-step workflows that orchestrate multiple job templates with conditional logic.

Navigate to Resources → Workflow Templates → Add:

Name: Complete Application Deployment
Organization: Production Environment
Description: Full application deployment with database migration
Options:
  - Enable Concurrent Jobs
  - Ask for Inventory on Launch

Configure workflow nodes:

1. Database Backup
   Job Template: Backup Production DB
   On Success: → Database Migration
   On Failure: → Send Alert

Database Migration
   Job Template: Run DB Migration
   On Success: → Deploy Application
   On Failure: → Restore Database

Deploy Application
   Job Template: Deploy Web Server
   On Success: → Health Check
   On Failure: → Rollback Deployment

Health Check
   Job Template: Application Health Check
   On Success: → Update Load Balancer
   On Failure: → Rollback Deployment

Update Load Balancer
   Job Template: Configure HAProxy
   On Success: → Send Success Notification

Configure job scheduling

Set up automated job execution schedules for routine maintenance and compliance tasks.

Navigate to a job template and add schedules:

# Daily Security Updates
Name: Daily Security Updates
Start Date/Time: Today 02:00 AM
Local Time Zone: UTC
Repeat Frequency: Daily
Run Every: 1 Day
Days of Data to Keep: 30

Weekly Backup
Name: Weekly Full Backup
Start Date/Time: Sunday 01:00 AM  
Local Time Zone: UTC
Repeat Frequency: Weekly
Run Every: 1 Week
On Days: Sunday

Set up notification channels

Configure Slack, email, and webhook notifications for job status updates and alerts.

Name: Infrastructure Alerts
Notification Type: Slack
Slack Webhook URL: https://hooks.slack.com/services/...
Slack Channel: #infrastructure
Slack Username: AWX Bot
Notification Messages:
  - Job Start: Started job {{ job_friendly_name }}
  - Job Success: ✅ {{ job_friendly_name }} completed successfully
  - Job Failure: ❌ {{ job_friendly_name }} failed: {{ job_result_stdout }}

Configure Vault integration

Set up secure secret management using Ansible Vault for sensitive variables and credentials. This builds on the foundation covered in our Ansible Vault configuration guide.

Name: Production Vault Password
Credential Type: Vault
Vault Password: your-vault-password
Vault Identifier: production

Apply vault credentials to job templates that use encrypted variables.

Set up HashiCorp Vault integration

Configure external HashiCorp Vault integration for enterprise secret management.

Name: HashiCorp Vault Production
Credential Type: HashiCorp Vault Secret Lookup
Server URL: https://vault.example.com:8200
Token: s.yourvaulttoken
CACert: [optional CA certificate]
Role ID: [for AppRole authentication]

Enable external logging

Configure centralized logging to external systems for audit trails and troubleshooting.

# Add logging configuration to awx-web service
logging:
  driver: syslog
  options:
    syslog-address: "tcp://your-log-server:514"
    tag: "awx-web"

Add logging configuration to awx-task service  
logging:
  driver: syslog
  options:
    syslog-address: "tcp://your-log-server:514" 
    tag: "awx-task"

Set up monitoring integration

Configure Prometheus metrics export for comprehensive AWX monitoring and alerting.

# In AWX web interface: Settings → System

Prometheus Metrics Enabled: True
Metrics Export Path: /api/v2/metrics/
Metrics Authentication: Token

Add to docker-compose.yml awx-web service
environment:
  ENABLE_METRICS: "True"
  METRICS_PATH: "/api/v2/metrics/"