As we have discussed so far, it is important to ensure that not only can you implement security policies in an efficient and repeatable manner, but that it should also be possible to audit them. There are a variety of tools available for this task, both closed source and open source. Before we consider any other tools, though, it is worthwhile looking at how Ansible itself can assist with this task.
Let's return to one of our original examples, where we were implementing two of the recommendations from section 5 of the CIS Benchmark.
Previously, we ran this with the following command:
$ ansible-playbook -i hosts site.yml
This ran through the two checks, implementing the changes if the system was not already compliant with the security recommendations. However, Ansible also has a mode of operation called check mode. In this mode, Ansible...
