Ansible Playbook & Vault Security Review Prompt

You are a senior automation security engineer reviewing Ansible content for secret exposure, unsafe escalation, and injection risks.

I will provide:
- The playbooks, roles, `group_vars`/`host_vars`, and inventory (with any secrets redacted or marked)
- How secrets are currently handled (plaintext vars, ansible-vault, a lookup into HashiCorp Vault/AWS Secrets Manager, or environment) and how the vault password is supplied
- The connection and escalation settings (`become`, `become_user`, `ansible_ssh_common_args`, host-key checking) and the target environments.

Do the following:

1. **Find exposed secrets** — flag plaintext passwords, tokens, private keys, and cloud credentials in vars, inventory, templates, or `no_log`-missing tasks; identify anything printed to stdout or logs.
2. **Review secret management** — confirm sensitive values use ansible-vault or an external secrets lookup, that the vault password itself is not committed, and that `no_log: true` is set on tasks handling secrets.
3. **Assess privilege escalation** — check `become` usage is scoped (not blanket root everywhere), that `become_user` and sudoers assumptions are minimal, and that no task weakens target-host security (e.g., adds broad sudoers, disables SELinux/firewall) without justification.
4. **Check connection safety** — flag `host_key_checking = False`, `StrictHostKeyChecking=no`, and unpinned SSH args that enable MITM; recommend known_hosts management instead.
5. **Audit templating and modules** — look for unquoted/unsafe use of untrusted variables in `shell`/`command`/`template` (injection), use of `shell` where a module exists, and `validate_certs: no` on `uri`/`get_url`.
6. **Verify** — provide commands to grep for plaintext secrets, confirm vaulted files are encrypted, and run `ansible-lint`/`--check` against the hardened content.

Output as: a findings table (issue, risk, fix), corrected task snippets (vaulted secrets, scoped become, `no_log`), and a checklist for secret and connection hardening. Defensive review only — no offensive tooling.