AWX

Connect Ansible AWX so agents can find failed jobs, inspect inventories and projects, and launch job templates through your Approvals

Connect AWX to let CloudThinker agents find failed jobs and read their output, inspect inventories, hosts, and projects, and launch a job template through your approvals. The connection signs in with one AWX access token and runs the awx command line tool against your server.

Prerequisites

• An AWX server, or an Ansible Automation Platform controller, reachable from CloudThinker over HTTPS. For a server on a private network, see Reaching private services.
• An AWX user for CloudThinker with access to the organizations, inventories, and templates agents should reach.

Setup

1. Create a user for CloudThinker

   In AWX, create a user such as cloudthinker and give it roles only on the resources agents need (see Required permissions). A dedicated user keeps the token’s reach small and easy to revoke.

2. Create an access token

   Sign in as that user. Open the user menu, select User Details, go to the Tokens tab, and click Add:

   • Application: leave empty
   • Scope: Read to monitor only, or Write if agents should launch and change things

   Copy the token. AWX shows it only once. The token expires after the period set in your AWX OAuth 2 settings, so note the date and create a new one before then.

3. Add the connection in CloudThinker

   Open More → Workspace settings → Connections, stay on the Builtin Connections tab, and select AWX. Fill in:

   • TOWER_HOST: your AWX address, such as https://awx.example.com
   • TOWER_OAUTH_TOKEN: the token you copied

   Click Connect. CloudThinker runs awx me with the token to confirm it can sign in.

   Success state: the dialog closes and the connection shows Connected. Run the verify prompt below.

Connection details

Field	Description	Example
TOWER_HOST	Base URL of your AWX server, HTTPS	https://awx.example.com
TOWER_OAUTH_TOKEN	The AWX personal access token for the CloudThinker user. The field keeps AWX’s older Tower name	<your-token>

Required permissions

Two things decide what agents can do: the token’s scope and the user’s roles in AWX. The token can never do more than the user. With a Write token, the user’s roles are the ceiling, and Approvals decides each action within it. To block every write in CloudThinker too, turn off the Allow writes switch on the AWX connection’s detail panel.

Goal	Token scope	AWX roles for the user
Monitor jobs, inventories, and projects	Read	Read on the organizations or resources to watch
Launch selected job templates	Write	Execute on those job templates or workflow templates
Sync projects	Write	Update on those projects
Change hosts and groups	Write	Admin on those inventories

Start with a Read token. Switch to Write only for the templates you want agents to run, and grant Execute per template rather than a broad organization role.

Agent capabilities

Capability	What agents can do	Approval
Discovery	Summarize the signed-in user, organizations, inventories, projects, job templates, workflow templates, and recent jobs	No
Jobs	List jobs and workflow jobs by status, read job details, and read output of finished jobs	No
Inventories	Inspect inventories, hosts, and groups	No
Projects	Check project source control and sync status	No
Templates and credentials	Read job templates, workflow templates, and credential metadata. Credential secrets are never returned	No
Launch	Launch a job template or workflow template with extra variables, then follow it to completion. The template must have Prompt on launch turned on for Variables	Yes
Control and sync	Cancel a running job, or sync a project from source control	Yes
Change resources	Create, modify, or delete hosts, groups, and other AWX resources	Yes

Every write goes through Approvals, and a rejected request isn’t retried. With a Read token, AWX refuses writes even after approval.

Verify the connection

Run AWX discovery and summarize my organizations, inventories, job templates, and the last few jobs with their status

Expect the user CloudThinker signed in as, then the names and counts of each resource type, then recent jobs with a status such as successful or failed.

Example prompts

List AWX jobs that failed in the last 24 hours and show the error from each job's output
Which AWX projects failed their last source control sync?
Launch the deploy-web job template with extra vars version=2.1.0 and tell me when it finishes

Use the real template, inventory, or project name. Agents look names up first and won’t guess IDs.

Troubleshooting

Connect fails with Failed to connect to AWX

CloudThinker couldn’t run awx me against TOWER_HOST. The dialog shows the same message for an unreachable server and a bad token, so check both. First open TOWER_HOST in a browser from outside your network: it must load over HTTPS. If it does, the token is expired or revoked. Create a new token, edit the connection, and paste it in.

Requests return 401

The token is missing, expired, or revoked. Create a new token for the CloudThinker user and update TOWER_OAUTH_TOKEN.

Launch or sync is refused

The token has Read scope, or the user lacks Execute on the template or Update on the project. Create a Write token or grant the role in AWX, then ask again.

Lists come back empty

The user can’t see those resources. Grant Read on the organizations or inventories agents should reach. No need to reconnect; roles apply on the next request.

Extra variables are ignored on launch

AWX drops extra variables unless the template allows them. Edit the job template, turn on Prompt on launch for Variables, and launch again.

Job output is empty

AWX returns output only after a job finishes. Ask again once the job’s status is successful or failed.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Read scope first: use a Write token only when agents should launch or change things, and scope the user’s roles to those templates.
• HTTPS only: always use an HTTPS TOWER_HOST. Plain HTTP sends the token in clear text.

Related

Approvals

Decide which AWX launches wait for a person.

Automation

Run AWX checks on a schedule, such as a daily failed-jobs report.