Ansible — cheat sheet

A one-page lookup for the commands and flags used across this course. Grouped by task; the course pages cover the why behind each one — this page is just the what.

Setup

Task	Command
Install ansible-core in a venv	python3 -m venv .venv && source .venv/bin/activate && pip install 'ansible-core>=2.16'
Check version + config search path	ansible --version
Show effective config (only what you overrode)	ansible-config dump --only-changed

Inventory

Task	Command
List parsed inventory (hosts + vars)	ansible-inventory --list
Show the group hierarchy	ansible-inventory --graph
Ping every host (SSH + Python check)	ansible all -m ping
Ping one group	ansible web -m ping

Ad-hoc commands

Task	Command
Run a module against a pattern	ansible <pattern> -m <module> -a '<args>'
Gather one fact filter	ansible web -m setup -a 'filter=ansible_distribution*'
Run as root	ansible web-01 -m service -a 'name=nginx state=restarted' --become
Run a raw shell command (last resort)	ansible prod -m shell -a 'uptime'

Running playbooks

Task	Command
Apply a playbook	ansible-playbook playbooks/site.yml
Dry-run, show would-be diffs	ansible-playbook site.yml --check --diff
Limit to one host/group	ansible-playbook site.yml --limit web-01
Run only tagged tasks	ansible-playbook site.yml --tags config
Run all except tagged tasks	ansible-playbook site.yml --skip-tags packages
List a playbook's tags without running it	ansible-playbook site.yml --list-tags
Resume from a specific task	ansible-playbook site.yml --start-at-task "Render site config"
Pass a one-off override (highest precedence)	ansible-playbook site.yml -e var=value
SSH-level debug output	ansible-playbook site.yml -vvv

Task result states

State	Meaning
ok	Module ran, host already matched desired state — nothing changed.
changed	Module made a change.
skipped	A when: condition was false.
failed	Task failed; the play halts on that host.

Roles & collections

Task	Command
Scaffold a new role	ansible-galaxy init roles/<name>
Install collections from a requirements file	ansible-galaxy collection install -r requirements.yml
Install roles from a requirements file	ansible-galaxy role install -r requirements.yml
Install one collection directly	ansible-galaxy collection install amazon.aws

Vault

Task	Command
Encrypt a file	ansible-vault encrypt group_vars/prod/vault.yml
Edit an encrypted file in place	ansible-vault edit group_vars/prod/vault.yml
View without editing	ansible-vault view group_vars/prod/vault.yml
Decrypt (rarely needed)	ansible-vault decrypt group_vars/prod/vault.yml
Rotate the password without exposing plaintext	ansible-vault rekey group_vars/prod/vault.yml --new-vault-password-file <path>
Encrypt a single inline value	ansible-vault encrypt_string 'hunter2' --name 'api_token'
Run a play, prompting for the vault password	ansible-playbook site.yml --ask-vault-pass
Run a play with a password file	ansible-playbook site.yml --vault-password-file ~/.ansible/vault-pass
Run a play with a labeled identity	ansible-playbook site.yml --vault-id prod@~/.ansible/vault-pass-prod

Variable precedence (low → high, the 9 that matter)

#	Source
1	Role defaults/main.yml
2	Inventory group_vars/all
3	Inventory group_vars/<other group>
4	Inventory host_vars
5	Playbook group/host vars (inline)
6	Play vars:
7	Role vars/main.yml
8	set_fact / registered variables
9	Command-line -e (extra-vars) — always wins

Common modules

Module	Use for
ansible.builtin.package	Install/remove an OS package (delegates to apt/dnf/yum).
ansible.builtin.service / systemd_service	Start/stop/enable a service.
ansible.builtin.copy	Push a file or literal content.
ansible.builtin.template	Render a Jinja2 template and push the result.
ansible.builtin.file	Manage path state: directory, symlink, perms, ownership.
ansible.builtin.lineinfile / blockinfile	Surgical single-line or delimited-block file edit.
ansible.builtin.user	Create/remove a Linux user.
ansible.posix.authorized_key	Add/remove an SSH key from authorized_keys.
ansible.builtin.command / shell	Run an arbitrary command — last resort; no idempotency for free.
ansible.builtin.uri	Hit an HTTP endpoint (smoke-test).
ansible.builtin.debug	Print a variable or message during a run.

Idempotency helpers

Directive	Use for
creates: / removes:	On command/shell — only run if a named file is absent/present.
changed_when:	Override the default change detection.
failed_when:	Override the default failure detection.
check_mode: false	Force a command/shell task to still run under --check.

Templating (Jinja2) essentials

Syntax	Does
{% if cond %}...{% endif %}	Conditional output
{% for item in seq %}...{% endfor %}	Loop
{%- ... -%}	Trim whitespace around the tag
{{ value \| default('x') }}	Fallback when a variable is undefined
{{ value \| mandatory }}	Error immediately if undefined

How this connects

The inventory & variables page covers the group hierarchy and precedence rules behind the table above, the roles & collections page covers how ansible-galaxy-managed roles are structured and reused, the templating & handlers page covers the full Jinja2 filter set and the notify/handler flow behind the syntax above, and the vault & secrets page covers the encryption workflow behind the ansible-vault commands above.