Dont ask for the credentials if specified in the environment vars

roles/cloud-azure/tasks/prompts.yml

@@ -5,37 +5,45 @@
  You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
  echo: false
  register: _azure_secret
- when: azure_secret is undefined
+ when:
+ - azure_secret is undefined
+ - lookup('env','AZURE_SECRET')|length <= 0
 
 - pause:
  prompt: |
  Enter your azure tenant id (https://github.com/trailofbits/algo/blob/master/docs/cloud-azure.md)
  You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
  echo: false
  register: _azure_tenant
- when: azure_tenant is undefined
+ when:
+ - azure_tenant is undefined
+ - lookup('env','AZURE_TENANT')|length <= 0
 
 - pause:
  prompt: |
  Enter your azure client id (application id) (https://github.com/trailofbits/algo/blob/master/docs/cloud-azure.md)
  You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
  echo: false
  register: _azure_client_id
- when: azure_client_id is undefined
+ when:
+ - azure_client_id is undefined
+ - lookup('env','AZURE_CLIENT_ID')|length <= 0
 
 - pause:
  prompt: |
  Enter your azure subscription id (https://github.com/trailofbits/algo/blob/master/docs/cloud-azure.md)
  You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
  echo: false
  register: _azure_subscription_id
- when: azure_subscription_id is undefined
+ when:
+ - azure_subscription_id is undefined
+ - lookup('env','AZURE_SUBSCRIPTION_ID')|length <= 0
 
 - set_fact:
- secret: "{{ azure_secret | default(_azure_secret.user_input|default(omit)) }}"
- tenant: "{{ azure_tenant | default(_azure_tenant.user_input|default(omit)) }}"
- client_id: "{{ azure_client_id | default(_aazure_client_id.user_input|default(omit)) }}"
- subscription_id: "{{ azure_subscription_id | default(_azure_subscription_id.user_input|default(omit)) }}"
+ secret: "{{ azure_secret | default(_azure_secret.user_input|default(None)) | default(lookup('env','AZURE_SECRET'), true) }}"
+ tenant: "{{ azure_tenant | default(_azure_tenant.user_input|default(None)) | default(lookup('env','AZURE_TENANT'), true) }}"
+ client_id: "{{ azure_client_id | default(_azure_client_id.user_input|default(None)) | default(lookup('env','AZURE_CLIENT_ID'), true) }}"
+ subscription_id: "{{ azure_subscription_id | default(_azure_subscription_id.user_input|default(None)) | default(lookup('env','AZURE_SUBSCRIPTION_ID'), true) }}"
 
 - block:
  - name: Set facts about the regions

roles/cloud-digitalocean/tasks/main.yml

@@ -2,7 +2,7 @@
  - name: Include prompts
  import_tasks: prompts.yml
 
- - name: Set the DigitalOcean Access Token fact
+ - name: Set additional facts
  set_fact:
  algo_do_region: >-
  {% if region is defined %}{{ region }}

roles/cloud-digitalocean/tasks/prompts.yml

@@ -4,11 +4,13 @@
  Enter your API token. The token must have read and write permissions (https://cloud.digitalocean.com/settings/api/tokens):
  echo: false
  register: _do_token
- when: do_token is undefined
+ when:
+ - do_token is undefined
+ - lookup('env','DO_API_TOKEN')|length <= 0
 
 - name: Set the token as a fact
  set_fact:
- algo_do_token: "{{ do_token | default(_do_token.user_input) | default(lookup('env','DO_API_TOKEN'), true) }}"
+ algo_do_token: "{{ do_token | default(_do_token.user_input|default(None)) | default(lookup('env','DO_API_TOKEN'), true) }}"
 
 - name: Get regions
  uri:

roles/cloud-ec2/tasks/prompts.yml

@@ -5,18 +5,22 @@
  Note: Make sure to use an IAM user with an acceptable policy attached (see https://github.com/trailofbits/algo/blob/master/docs/deploy-from-ansible.md)
  echo: false
  register: _aws_access_key
- when: aws_access_key is undefined
+ when:
+ - aws_access_key is undefined
+ - lookup('env','AWS_ACCESS_KEY_ID')|length <= 0
 
 - pause:
  prompt: |
  Enter your aws_secret_key (https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
  echo: false
  register: _aws_secret_key
- when: aws_secret_key is undefined
+ when:
+ - aws_secret_key is undefined
+ - lookup('env','AWS_SECRET_ACCESS_KEY')|length <= 0
 
 - set_fact:
- access_key: "{{ aws_access_key | default(_aws_access_key.user_input|default(omit)) | default(lookup('env','AWS_ACCESS_KEY_ID'), true) }}"
- secret_key: "{{ aws_secret_key | default(_aws_secret_key.user_input|default(omit)) | default(lookup('env','AWS_SECRET_ACCESS_KEY'), true) }}"
+ access_key: "{{ aws_access_key | default(_aws_access_key.user_input|default(None)) | default(lookup('env','AWS_ACCESS_KEY_ID'), true) }}"
+ secret_key: "{{ aws_secret_key | default(_aws_secret_key.user_input|default(None)) | default(lookup('env','AWS_SECRET_ACCESS_KEY'), true) }}"
 
 - block:
  - name: Get regions

roles/cloud-gce/tasks/prompts.yml

@@ -4,10 +4,12 @@
  Enter the local path to your credentials JSON file
  (https://support.google.com/cloud/answer/6158849?hl=en&ref_topic=6262490#serviceaccounts)
  register: _gce_credentials_file
- when: gce_credentials_file is undefined
+ when:
+ - gce_credentials_file is undefined
+ - lookup('env','GCE_CREDENTIALS_FILE_PATH')|length <= 0
 
 - set_fact:
- credentials_file_path: "{{ gce_credentials_file | default(_gce_credentials_file.user_input|default(omit)) | default(lookup('env','GCE_CREDENTIALS_FILE_PATH'), true) }}"
+ credentials_file_path: "{{ gce_credentials_file | default(_gce_credentials_file.user_input|default(None)) | default(lookup('env','GCE_CREDENTIALS_FILE_PATH'), true) }}"
  ssh_public_key_lookup: "{{ lookup('file', '{{ SSH_keys.public }}') }}"
 
 - set_fact:

roles/cloud-lightsail/tasks/prompts.yml

@@ -5,18 +5,22 @@
  Note: Make sure to use an IAM user with an acceptable policy attached (see https://github.com/trailofbits/algo/blob/master/docs/deploy-from-ansible.md)
  echo: false
  register: _aws_access_key
- when: aws_access_key is undefined
+ when:
+ - aws_access_key is undefined
+ - lookup('env','AWS_ACCESS_KEY_ID')|length <= 0
 
 - pause:
  prompt: |
  Enter your aws_secret_key (https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
  echo: false
  register: _aws_secret_key
- when: aws_secret_key is undefined
+ when:
+ - aws_secret_key is undefined
+ - lookup('env','AWS_SECRET_ACCESS_KEY')|length <= 0
 
 - set_fact:
- access_key: "{{ aws_access_key | default(_aws_access_key.user_input|default(omit)) | default(lookup('env','AWS_ACCESS_KEY_ID'), true) }}"
- secret_key: "{{ aws_secret_key | default(_aws_secret_key.user_input|default(omit)) | default(lookup('env','AWS_SECRET_ACCESS_KEY'), true) }}"
+ access_key: "{{ aws_access_key | default(_aws_access_key.user_input|default(None)) | default(lookup('env','AWS_ACCESS_KEY_ID'), true) }}"
+ secret_key: "{{ aws_secret_key | default(_aws_secret_key.user_input|default(None)) | default(lookup('env','AWS_SECRET_ACCESS_KEY'), true) }}"
 
 - block:
  - name: Get regions