Uploaded image for project: 'Ansible Automation Platform RFEs'
  1. Ansible Automation Platform RFEs
  2. AAPRFE-2341

[RFE] Enhance Ansible Controller collections to include built-in audit and traceability metadata for job and workflow launches.

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • 2.4, 2.5
    • certified-content
    • False
    • Hide

      None

      Show
      None
    • False

      Currently, when using Ansible Controller modules/plugins (e.g., ansible.controller.job_launch) within playbooks, there is no native mechanism to track the source details of a launched Job or Workflow. This limits auditability and security visibility.

      To improve traceability, it is requested to include the following metadata fields natively in all Controller modules/plugins:

      • awx_job_id
      • awx_job_template_name
      • awx_user_name

      These details should be automatically captured and associated with each job/workflow execution, enabling better audit trails and preventing misuse of the platform.

      Use Case:
      Without these built-in fields, administrators need to rely on manually passing extra_vars, which is error-prone, inconsistent, and cannot be enforced easily. Native support would ensure that:

      • All job launches have consistent traceability data.
      • Security and compliance requirements are met.
      • Audit teams can quickly identify who launched a job, from where, and when.

      Example Request:
      When launching a job using ansible.controller.job_launch, the metadata fields should be automatically recorded without needing manual intervention. extra_vars injection:

      • name: Launch a Job
        ansible.controller.job_launch:
        controller_host: "{{ controller_host }}"
        controller_oauthtoken: "{{ controller_oauthtoken }}"
        name: "{{ aap_resource_sync__template_name }}"
        organization: 'VF'
        wait: false
        extra_vars:
        scope_to_create: "{{ aap_resource_sync__scope_to_create }}"
        is_private: "{{ is_private }}"
        role_action: "{{ aap_resource_sync__role_action | default(omit) }}"
        parent_job_id: "{{ awx_job_id }}"
        parent_job_template: "{{ awx_job_template_name }}"
        launched_by: "{{ awx_user_name }}"
        Impact:
        Lack of this feature is currently a blocker for environments with strict security and compliance needs, as they cannot guarantee complete audit trails for controller collection usage.

              dmendoza@redhat.com Dafne Mendoza
              rhn-support-nikhjain Nikhil Jain
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: