skills.rest
hashi-demo-lab
hashi-demo-labOFFICIAL
Explore all skills by this author →
GitHub

aap-vault-ssh

Provision dynamic Vault-signed SSH credentials for AAP environments via Terraform and Ansible.

1|1|Updated Nov 19, 2025
Search Tags:#automation#vault#ssh#multitenant#aap#approle#certificate-signing
One-click install
npx skills add https://github.com/hashi-demo-lab/terraform-provider-bcm --skill aap-vault-ssh
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aap-vault-ssh
Source: https://github.com/hashi-demo-lab/terraform-provider-bcm/tree/main/.claude/skills/aap-vault-ssh
Command: npx skills add https://github.com/hashi-demo-lab/terraform-provider-bcm --skill aap-vault-ssh

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables dynamic, signed SSH credentials for Ansible Automation Platform (AAP) by integrating HashiCorp Vault's SSH CA with AppRole-based auth. It eliminates manual SSH key provisioning and reduces credential exposure across multi-tenant environments.

Core Features & Use Cases

  • Vault SSH CA integration: sign per-tenant SSH certificates via AppRole.
  • AppRole-based onboarding: automate credentials provisioning for new tenants.
  • Golden image and rotation support: leverages Vault for certificate rotation and trusted CA deployment to images.

Quick Start

Configure Vault AppRole and SSH secrets engine for a tenant. See references/aap-config.md and references/vault-config.md for complete Terraform and Vault setup.

Frequently Asked Questions about aap-vault-ssh

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate dynamic SSH credentials for Ansible Automation Platform using Vault?▼

Dynamic SSH credentials for Ansible Automation Platform (AAP) are generated by integrating Vault's SSH secrets engine with AppRole authentication to sign per-tenant SSH certificates automatically.

What's the best way to automate SSH key provisioning for multi-tenant infrastructure?▼

Automating SSH key provisioning for multi-tenant infrastructure relies on Vault AppRole onboarding combined with Terraform and Ansible to deploy tenant-scoped roles and signed certificates dynamically.

Do I need the Vault SSH secrets engine to sign certificates for AAP environments?▼

Yes, the Vault SSH secrets engine is required to act as a certificate authority, signing per-tenant SSH certificates that Ansible Automation Platform uses for secure dynamic authentication.

Can I rotate SSH certificates automatically with Vault and Ansible?▼

Yes, automatic SSH certificate rotation is supported by leveraging Vault's SSH CA capabilities alongside trusted CA deployment to golden images, ensuring continuous credential security across tenants.

How does Vault AppRole authentication work for tenant onboarding?▼

Vault AppRole authentication for tenant onboarding automates secure credentials provisioning by assigning tenant-scoped roles, allowing Ansible Automation Platform to request dynamic SSH certificates without manual key distribution.

Are there limitations when using Vault-signed SSH credentials in a multi-tenant AAP setup?▼

Vault-signed SSH credentials in multi-tenant AAP setups require configuring the SSH secrets engine, AppRole auth, and tenant-scoped roles beforehand, making initial setup complex but eliminating ongoing manual key management.

Related Skills

Explore More Software Engineering Skills→
somachaksomachak

managing-secrets-infrastructure

Design and audit production secrets infrastructure across Vault and cloud secret stores.

Community
Advanced
phuetzphuetz
30

terraform-ansible

Provision cloud infrastructure with Terraform and configure it using Ansible playbooks.

Community
Advanced
Lobbi-DocsLobbi-Docs
18

vault-operations

Automate HashiCorp Vault secret management and dynamic credential rotation.

Official
Advanced
BagelHoleBagelHole
46

hashicorp-vault

Manage secrets, PKI, and dynamic credentials with HashiCorp Vault.

Community
Advanced