Ansible Tower / Automation Controller

Credentials5 documented

OAuth2 / Personal Access Token

ansible-tower / oauth2-token

Ansible Tower, AWX, and Automation Controller support OAuth2 token authentication for API access. Tokens are used by awx CLI, collection modules, API clients, and automation integrations instead of passwords.

generated on installsecrettoken

Location

environment

CONTROLLER_OAUTH_TOKEN, TOWER_OAUTH_TOKEN, AAP_TOKEN

Official AWX collection/controller API environment fallbacks for OAuth token authentication

http header

Authorization

Bearer token used for Automation Controller API requests

config file

/etc/tower/tower_cli.cfg, ~/.tower_cli.cfg

Tower/AWX CLI and collection config files that can contain oauth_token

config file

%USERPROFILE%\.tower_cli.cfg

Windows home-relative Tower/AWX CLI config file

config file

.tower_cli.cfg, tower_cli.cfg

Local/project Tower CLI config files supported by tower-cli/AWX collection tooling

database

Controller database tables storing OAuth applications and tokens

secret store

CI/CD variables, credential stores, Kubernetes Secrets, Ansible Vault, and cloud secret managers

source code

Playbooks, inventory plugins, tests, committed API clients, and automation repositories

logs

API client traces, AWX collection debug output, and CI output

Notes

Token privileges follow the owning user, OAuth application, scopes, and RBAC configuration. No stable public token prefix was confirmed, so no token-value regex is added.

Administrator/User Password

ansible-tower / admin-user-password

Automation Controller users authenticate to the web UI and API through local, LDAP, SAML, or other configured authentication backends. Local admin credentials are created during installation or provisioning and can be supplied to CLI/collection tooling through environment variables or tower_cli.cfg files.

generated on installuser definedsecretusername/password

Looks like

pattern

Password assignment in tower_cli.cfg-style controller config files; use with Ansible Tower/AWX config-file context

(?im)^\s*(password|admin_password)\s*=\s*[^\s#]{6,255}\s*$

Location

environment

CONTROLLER_PASSWORD, TOWER_PASSWORD, AAP_PASSWORD

Official AWX/Automation Controller CLI and collection password environment fallbacks

public interface

/, /api/, /api/v2/, /login/

Automation Controller UI and API login contexts

config file

/etc/tower/tower_cli.cfg, ~/.tower_cli.cfg

Tower/AWX CLI and collection config files that can contain username/password

config file

%USERPROFILE%\.tower_cli.cfg

Windows home-relative Tower/AWX CLI config file

config file

.tower_cli.cfg, tower_cli.cfg, inventory

Local CLI config and installer inventory files that may contain admin credentials

database

Controller database user tables and password verifier state for local accounts

secret store

Installer inventory secrets, Kubernetes Secrets, Ansible Vault, password managers, and external credential stores

source code

Installer inventories, playbooks, tests, committed variables, and automation repos

logs

Installer logs, setup output, awx CLI traces, collection debug logs, and authentication traces

Notes

There is no universal Tower administrator password; it is generated or set during deployment. CONTROLLER_HOST/TOWER_HOST/AAP_HOST are endpoint context, not credential values, and are intentionally omitted from environment locations.

Stored Automation Credential

ansible-tower / stored-credential-secret

Automation Controller stores machine, SCM, cloud, vault, and custom credentials for use by jobs. Red Hat documentation covers secret handling for encrypted credential values in the controller.

user definedsecretsecret value

Location

database

Controller database storing encrypted credential fields

config file

/etc/tower/settings.py, /etc/tower/conf.d/postgres.py, /etc/tower/conf.d/custom.py, /etc/tower/conf.d/channels.py, /etc/tower/conf.d/database.py, /etc/tower/conf.d/websocket_secret.py, /etc/tower/conf.d/local_settings.py

Controller settings and exact conf.d files seen in AWX source/support tooling that may contain database, channel, websocket, or local secrets

secret store

Ansible Vault, Kubernetes Secrets, external credential plugins, cloud secret managers, and controller encrypted credential storage

source code

Exported surveys, test fixtures, accidentally committed inventories, playbooks, and collection configs

logs

Job output, callback logs, event stdout, and debugging traces if no_log is missing

Notes

Stored credentials may be SSH private keys, sudo passwords, cloud keys, SCM tokens, vault passwords, and arbitrary integration secrets. Product-specific storage is modeled here; generic private-key and common cloud-token patterns belong to their canonical templates or built-ins.

Controller SECRET_KEY

ansible-tower / controller-secret-key

AWX/Automation Controller uses a SECRET_KEY to protect encrypted fields and other sensitive application state. AWX source reads /etc/tower/SECRET_KEY and supports TOWER_SECRET_KEY for the secret-key regeneration command.

generated on installsecretsecret value

Looks like

pattern

Controller/AWX SECRET_KEY assignment in settings or support/config files

(?im)^\s*SECRET_KEY\s*=\s*['"]?[A-Za-z0-9+/=_:-]{20,255}['"]?\s*$

Location

environment

TOWER_SECRET_KEY

AWX secret-key regeneration command can use this env var as an existing key input

config file

/etc/tower/SECRET_KEY, /etc/tower/settings.py, /etc/tower/conf.d/custom.py, /etc/tower/conf.d/local_settings.py

Controller SECRET_KEY file and settings files from AWX source/support tooling

secret store

Kubernetes Secrets, deployment secrets, Ansible Vault, backup vaults, and controller secret stores

artifact

Controller backups, support bundles, sosreports, and installation archives

logs

Secret-key regeneration logs, setup logs, backup/restore output, and troubleshooting traces

Notes

AWX_SETTINGS_FILE and AWX_SETTINGS_DIR are path/context variables, not secret values, so they are not listed as credential environment locations.

Controller TLS Private Key

ansible-tower / tls-private-key

Automation Controller deployments use TLS keys and certificates for web/API endpoints and ingress. AWX support tooling references exact legacy key files under /etc/tower.

generated on installuser definedsecretkey pair

Looks like

pattern

TLS/private-key material in Controller/AWX deployment artifacts or exact key files

-----BEGIN (RSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----

Location

config file

/etc/tower/tower.key, /etc/tower/awx.key

Exact private-key files referenced by AWX sosreport tooling

secret store

Kubernetes TLS Secrets, certificate managers, vaults, and deployment secret stores

artifact

Controller backups, support bundles, sosreports, and deployment archives

logs

TLS, ingress, and setup troubleshooting logs

Notes

Generic private-key paths are not repeated here; only AWX/Tower-owned exact key files are included.

OAuth2 / Personal Access Token

Location

Notes

Administrator/User Password

Looks like

Location

Notes

Stored Automation Credential

Location

Notes

Controller SECRET_KEY

Looks like

Location

Notes

Controller TLS Private Key

Looks like

Location

Notes

Authorized use