Ansible cheatsheet

# Run a playbook against a limited group
ansible-playbook provision.yml -i inventories/emea --limit ring1

# Dry run (check mode) + diff
ansible-playbook provision.yml -i inventories/emea --check --diff

# Pass extra vars
ansible-playbook provision.yml -e "region=westeurope env=prod"

# Target a single host
ansible-playbook remediate.yml --limit web01.emea

# List hosts a play would touch
ansible-playbook provision.yml -i inventories/emea --list-hosts

# Vault: edit an encrypted var file (secrets NEVER in plain text)
ansible-vault edit group_vars/prod/secrets.yml

Secrets

Prefer Key Vault lookups over Ansible Vault where possible. Never commit decrypted secrets.

Common flags

Flag	Meaning
--limit	restrict to hosts/groups
--check	dry run
--diff	show changes
-e	extra vars
--tags / --skip-tags	run subset of tasks