Ansible Tower / AWX Tutorial: Learn Automation Controller from Scratch (2026)
Running Ansible playbooks from the command line works for ten servers. When you manage hundreds, you need a control plane. AWX adds a web UI, REST API, job scheduling, credential management, and RBAC on top of Ansible.
By the end of this tutorial, you will know how to deploy AWX on Kubernetes, create job templates with surveys, manage credentials securely, and chain automation into workflows with approvals.
AWX Architecture and Installation
AWX runs as containers on Kubernetes using the awx-operator. Key components: the web UI (Django), task engine, callback receiver, and Receptor mesh. The operator handles PostgreSQL, Redis, and persistent volumes. Installation requires cert-manager and a storage class.
kubectl create namespace awx
kubectl apply -f https://raw.githubusercontent.com/ansible/awx-operator/devel/awx-operator.yaml -n awx
kubectl port-forward svc/awx-demo-service 8080:80Organizations, Teams, and RBAC
AWX organizes automation around Organizations, Teams, and Users. An Organization represents a business unit. Teams inherit roles: Admin, Execute, Read. The RBAC model has organization-level, team-level, and object-level permissions. LDAP or SAML syncs users from your identity provider.
awx organizations create --name Engineering
awx teams create --name Platform --organization Engineering
awx users create --username jane --email jane@example.comInventories, Hosts, and Dynamic Sources
Static inventories are defined manually. Dynamic sources sync from AWS EC2, Azure, GCP, VMware, and more. I set up AWS EC2 inventory that tags instances by environment. Smart inventories create dynamic collections based on filters.
awx inventories create --name Production --organization Engineering
awx hosts create --name web-01 --inventory Production
awx inventory_sources create --name AWS-Sources --source ec2 --inventory ProductionJob Templates and Surveys
A job template ties together inventory, project, credential, and playbook. Surveys add parameterized inputs — text fields, multiple choice — that become extra vars. Prompt on launch lets users override credentials and inventory at runtime.
awx job_templates create --name "Deploy MyApp" --inventory Production --project myapp --playbook deploy.ymlWorkflows and Workflow Templates
Workflows chain multiple job templates with conditional logic based on success, failure, or always conditions. I build deployment workflows with approval gates. Workflow visualization in AWX shows the entire graph with node statuses.
awx workflow_job_templates create --name "Production Deploy"
awx workflow_job_template_nodes create --workflow "Production Deploy" --job_template "Smoke Test"Credentials, Vault, and Security
AWX stores credentials encrypted in the database. Credential types include machine, network, and Vault. The credential injection model creates temporary files removed after the job. External secret management integration is supported through custom credential plugins.
awx credentials create --name "AWS Access" --credential_type "Amazon Web Services"
awx job_templates associate --job_template "Deploy MyApp" --credential "AWS Access"Frequently Asked Questions
What is the difference between AWX and Ansible Tower?
AWX is the open-source upstream. Tower/AAP adds enterprise support, certified content collections, analytics, and Red Hat services. Functionally they are similar.
Does AWX replace the ansible-playbook command?
No. AWX provides a platform for running playbooks at scale. Local runs for development and AWX for production automation with RBAC is a common pattern.
How do I schedule jobs in AWX?
Job templates have a schedule tab for cron-like schedules. I schedule compliance checks daily, patch management weekly, and application deployments with manual approval.
Can AWX run playbooks on Windows hosts?
Yes. Use Windows credential type (username/password with WinRM). The control node must have pywinrm installed. Use the ansible.windows collection modules.
Originally published on Ayodhyyya. Last updated June 1, 2026.