Today, IaCM Ansible can only authenticate to target hosts using an SSH private key defined as an inventory variable (ansible_ssh_private_key_file), or WinRM for Windows. This forces us to store and rotate SSH keys in Harness secrets, keep port 22 reachable from the delegate and Ansible container, and maintain inbound security-group rules that allow the delegate's IP range. For teams running on AWS, this is exactly the surface area we're trying to eliminate.

We'd like IaCM Ansible to support connecting to EC2 instances through AWS Systems Manager Session Manager, using a Harness AWS Connector as the credential source. This maps to Ansible's built-in community.aws.aws_ssm connection plugin. With SSM, there are no SSH keys to manage, no open port 22, and no inbound security-group rules — instances are reached through the SSM agent and IAM, which also means private instances with no public IP and no bastion become reachable.

Concretely, we'd want to select an existing AWS Connector on the inventory (or stage) and have Harness wire its credentials into the Ansible run as the SSM connection, instead of requiring an SSH key. Windows targets managed by SSM would benefit as well.

This would make IaCM Ansible a much better fit for security-conscious AWS environments where SSH key distribution and open SSH ports are not acceptable, and it keeps credential management consistent with how the rest of the Harness platform already authenticates to AWS.