Compliance as Code: Automating RHEL Security with Ansible
Red Hat's Compliance as Code approach transforms security hardening from manual checklists into automated, version-controlled Ansible playbooks. Learn how to implement DISA STIG compliance across RHEL infrastructure with simple true/false configuration switches.
What is Compliance as Code?
Compliance as Code extends the Infrastructure as Code (IaC) paradigm to security compliance. Instead of manually applying security controls from lengthy PDF documents (like DISA STIGs or CIS Benchmarks), compliance requirements are codified into automated, repeatable, and testable configurations.
Red Hat's approach leverages Ansible automation to apply security baselines consistently across entire fleets of RHEL systems, ensuring:
- Consistency: Same security posture across all systems
- Repeatability: Deploy compliant systems at scale
- Version Control: Track compliance changes over time with Git
- Auditability: Automated compliance reporting and evidence collection
- Agility: Rapidly update configurations as requirements evolve
DISA STIG Automation with Ansible
The ansible-role-rhel9-stig repository provides a production-ready Ansible role that implements all DISA STIG controls for RHEL 9. This role transforms a 400+ page security technical implementation guide into automated configuration management.
Key Features:
- Comprehensive Coverage: All DISA STIG V1R1 controls for RHEL 9
- Idempotent: Safe to run multiple times without side effects
- Customizable: Toggle individual controls via simple YAML variables
- Reporting: Generates compliance reports post-execution
- CI/CD Ready: Integrate into automated deployment pipelines
Implementation Architecture
Traditional Approach
- Read 400+ page STIG PDF
- Manually configure each control
- Document changes in spreadsheet
- Hope configurations don't drift
- Manual re-checks for compliance
- Weeks to harden a fleet
Compliance as Code
- Edit YAML configuration file
- Run Ansible playbook
- Git tracks all changes
- Automated drift detection
- Continuous compliance validation
- Minutes to harden a fleet
Configuration Example
The power of Compliance as Code lies in its simplicity. Here's how to customize STIG controls
in the defaults/main.yml file:
# Enable/disable specific STIG controls
rhel9stig_cat1_patch: true # Apply Category 1 (Critical) controls
rhel9stig_cat2_patch: true # Apply Category 2 (High) controls
rhel9stig_cat3_patch: false # Skip Category 3 (Medium) controls
# Customize specific controls for your organization
rhel9stig_sssd_offline_cred_expiration: 1 # Days before cached credentials expire
rhel9stig_pass_min_length: 15 # Minimum password length
rhel9stig_pass_max_days: 60 # Maximum password age
# Toggle individual STIG rules
rhel9stig_rule_010010: true # RHEL 9 must be a vendor-supported release
rhel9stig_rule_010020: true # RHEL 9 must display Standard Mandatory DoD Notice
rhel9stig_rule_020010: true # RHEL 9 must implement NIST FIPS-validated cryptography
# Skip rules that don't apply to your environment
rhel9stig_rule_230285: false # Skip if not using GUI
rhel9stig_rule_230310: false # Skip if wireless not presentDeployment Workflow
Integrating STIG automation into your infrastructure deployment pipeline:
- Define Baseline: Fork the ansible-role-rhel9-stig repository
- Customize Defaults: Edit
defaults/main.ymlto match organizational requirements - Version Control: Commit configurations to private Git repository
- Test in Dev: Apply playbook to development VMs and validate
- Automate: Integrate into CI/CD pipeline for all RHEL deployments
- Continuous Compliance: Schedule periodic playbook runs to prevent drift
- Audit: Generate compliance reports for security assessments
Benefits for Defense Infrastructure
In defense and intelligence environments, Compliance as Code provides critical capabilities:
- Rapid ATO: Accelerate Authority to Operate with automated evidence collection
- Zero Trust: Enforce least-privilege configurations consistently
- Incident Response: Quickly re-harden compromised systems
- Supply Chain Security: Validate configurations in disconnected networks
- Continuous Monitoring: Detect and remediate drift automatically
Important: Always test STIG automation in non-production environments first.
Some controls may break application functionality or cause system instability. Use
--check mode to preview changes before applying.
Conclusion
Red Hat's Compliance as Code approach represents a paradigm shift in how organizations manage
security compliance. By codifying DISA STIGs into Ansible automation, security engineers can
harden infrastructure at scale with simple configuration changes. The defaults/main.yml
file becomes your organization's security policy—version-controlled, auditable, and automatically
enforced.