ansible-lint security

ansible-lint <playbook.yml>

Analyze Ansible playbooks with ansible-lint, detecting errors, bad practices, and security issues in automation.

Run it in the IaC pipeline when you want to lint the playbooks: ansible-lint analyzes the files (playbooks, roles, tasks) and reports findings — syntax errors, bad practices (commands without idempotency, shell), security issues (secrets in playbooks, permissions, shell execution with variables) — with rules and severity. It is the reference Ansible linter (from the project community): the automation analysis. In DevSecOps, ansible-lint is the gate of the Ansible pipeline: findings block the playbook merge.

Do not use it as a complete security analysis: ansible-lint covers the project rules — organizational policies (role conventions) are configured in .ansible-lint. Generic rules generate false positives (legitimate contexts): they are triaged and configured (skip_list). And note: ansible-lint analyzes the playbook code — the actual state of the managed system is covered by audits (post-verification). Combining with ansible-test (execution) covers the cycle.