Credentials, Teams & RBAC
Secure who runs what, where.
Credentials, Teams & RBAC is a free Ansible Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ansible Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Secrets Out of Your Code
AWX stores SSH keys, passwords and cloud tokens as credentials, encrypted in its database, so secrets never sit in playbooks or Git. 🔐
Credentials Are Typed
Each credential has a type, like Machine, Source Control or Amazon Web Services, which decides exactly which fields AWX collects and injects.
Write-Only by Design
Once saved, secret fields become write-only: you can replace them but never read them back, so a stolen UI session cannot leak the value.
Machine Credentials
A Machine credential holds the SSH username, key and privilege-escalation password jobs use to connect to and become root on hosts.
Users Are People
Every person logging into AWX is a user. Permissions can be granted to a user directly, but that gets unmanageable fast at scale.
Teams Group Users
A team bundles users together so you grant access once to the group, and adding a new hire is just dropping them onto the team. 👥
RBAC: Who Can Do What
Role-based access control grants specific roles on specific objects, so a user only sees and runs exactly what their job requires.
Roles per Object
On a job template you can grant the Execute role to run it, or Admin to edit it, keeping operators able to launch but not rewrite jobs.
Organizations on Top
An organization is the top container holding projects, inventories, teams and credentials, letting one AWX serve many isolated tenants.
Least Privilege
RBAC lets you follow least privilege: grant the minimum role needed. Auditors might read job results while never touching credentials.
Credentials Stay Hidden
A user can be given a credential to use in a template without ever being able to view its secret, separating who runs from who knows. 🛡️
Quick Check
How do you grant the same access to many users at once efficiently?
Recap
Credentials lock secrets away write-only, teams group users, and RBAC grants least-privilege roles per object so people run only what they should. ✅
Frequently asked questions
Is the “Credentials, Teams & RBAC” lesson free?
Yes — the full text of “Credentials, Teams & RBAC” is free to read here on the web, and the Ansible Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ansible Academy course, upgrade to CoddyKit PRO.
What will I learn in “Credentials, Teams & RBAC”?
Secure who runs what, where. You practise Ansible Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ansible Academy?
No prior experience is required. Ansible Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Credentials, Teams & RBAC” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ansible Academy lesson?
Yes. Every Ansible Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- AWX vs Automation Platform vs CLI
- Projects, Inventories & Job Templates
- Credentials, Teams & RBAC
- Schedules, Surveys & Workflows