Ansible - Automation remote or local?

Question

If I have to build an infrastructure stack in the cloud using a tool like Ansible. Is it necessary to have the automation tool and scripts locally or we can I just have automation tool and stack in seperate regions/VPCs in the cloud?

Which is the best to use?

Answer 1

It allows us to use centralized Jenkins servers that run Ansible (and Terraform in our case for the actual AWS provisioning with Ansible is just used to configure EC2 instances and run its ad-hoc playbooks for administrative tasks).We can then control access to these Jenkins servers through credentials and/or security groups/NACLs. Doing it this way means we can control the amount of people who have some form of credentials that would allow them to build anything they like and/or destroy anything they like. Ideally, we would only provide credentials to the Jenkins servers via IAM EC2 instance roles but we're not quite there yet. One real positive out of this is that our front line/second line support guys who use Windows pretty much exclusively can access a nice web GUI for managing things in the middle of the night and run Jenkins jobs that they specifically have access to run that will do things such as restarting a server/service or even rebuilding part of a VPC. We've got a separate 'dev' account that developers have access to from their own machines and it's here that we build things out as we develop our Ansible (and Terraform) code base before that code base is then used in our test and production environments.