Configuration
Run Ansible playbooks and provisioning assets against hypervisors, cloud VMs, Kubernetes clusters, and databases.
No targets available
Enable at least one on-premises integration in Settings → Integrations, or deploy cloud VMs via the AWS / Azure / GCP tabs so they appear here. A provisioned or registered database or Kubernetes cluster counts as a target as well — it runs a localhost play, so no SSH host is needed.
Run an Asset
Loading assets…
No assets found. Upload .yml,
.sh,
.ps1,
.deb,
.rpm,
.exe, or
.msi files on the
Storage page — the backend itself is
configured in Settings → Integrations → Ansible.
Bulk run: from inventory
One job per resource. Secrets below apply to every one of them; a managed account is matched by name on each host, so each checks out its own credential.
Runs on the directory's agent as its Password Safe account, checked out for this run only. WinRM uses HTTPS (5986); blank host means the directory's own.
Runs a localhost play on the in-cloud runner; connection details (kubeconfig / DB admin credentials / the Portainer URL and API token) are injected automatically — no SSH user or key.
Cloud VMs are read from the instance lists on the AWS / Azure / GCP tabs.
Passed to the playbook as that var (redacted from job output). Works on the local and cloud runners.
Pick this when the account escalates through a privilege broker rather than
sudo. An account entitled in PMUL usually has no sudoers entry, and the sudo
failure is unreadable: the prompt lands in the module's output and Ansible
reports No start of json char found.
Credentials are handed to Ansible as the connection/become secret — Ansible no_logs
these, so they can't be printed. Become and SSH-key secrets also work on the cloud runner.
For a cloud VM, auto retrieves the keypair the VM was actually deployed with
(from its deploy record) — pick a secret above only to override it.
Name a variable and the run mints a fresh BeyondTrust EPM-L installation
token for it. The token is fetched server-side at run time, never shown
and never stored on the job — registration tokens are short-lived, so one
saved anywhere would already be dead. See
examples/playbooks/linux/epml-activate.yml.
Managed account (Password Safe — checked out just-in-time)
Each target checks out its own credential. Pick a default below to pre-select every row, then override any row that differs.
Looking up managed accounts for each target…
Too many managed systems matched this selection to list them all. The rows below may be incomplete — narrow the selection, or run the affected hosts separately with an account picked from each one's own list.
No matching managed account — this target will fall back to the default account name and, if that host does not have it, fail its own job.
of targets have no account selected. You can still run — each one fails only its own job.
Looking up managed accounts…
No Password Safe managed accounts found for this host.
Sets ansible_user to the account and injects its credential (SSH key → connection
key; password → ansible_ssh_pass). Checked out just-in-time; you never see the value.
Works on the local and Azure (ACI) runners, and on ECS / Cloud Run via a short-lived RBAC-locked store copy; not on ECS / Cloud Run.
Starts at this time, and is marked missed if it has not started within the grace period — it will never run late.
No change windows are defined yet. An administrator can add them in Settings.
Next:
–
UTC
Available Targets
On-Premises
EC2 (AWS)
Azure VMs
GCE (GCP)
Kubernetes Clusters
Databases
Portainer
Add on-prem targets in Settings → Integrations. Cloud VMs, Kubernetes clusters, and databases appear automatically once deployed or registered.