AWX

Red Hat open-sourced AWX in 2017 as the upstream codebase for Ansible Tower, establishing an open development stream for Ansible's web console and job engine. It serves as the foundation for Red Hat Ansible Automation Platform, providing inventory management, role-based access control, and playbook scheduling without commercial license fees. Because it functions as an active upstream testbed, adopting it requires managing your own operational maintenance and absorbing ongoing architecture shifts.

Why AWX instead of Ansible Tower

AWX shares the core control plane of Ansible Tower and its successor, Red Hat Ansible Automation Platform controller. Both provide a React web UI, REST API, role-based access control, encrypted credential storage, and a visual workflow designer that chains playbooks across inventories. Adopting AWX lets engineering teams eliminate uncoordinated CLI runs and scattered SSH keys without per-node licenses. However, while Tower delivers vendor-supported packages, certified collections, and long-term release stability under commercial SLAs, AWX operates as an unsponsored upstream stream without vendor support contracts or backported security fixes.

Operationally, AWX demands a different infrastructure footprint than traditional Ansible Tower environments. Legacy Tower installed on standard Linux virtual machines via an automated setup script, whereas modern AWX mandates Kubernetes or OpenShift managed by the AWX Operator. This model introduces container administration overhead, requiring teams to maintain Execution Environment container images, Kubernetes custom resource definitions, and persistent storage for PostgreSQL. For teams with existing Kubernetes clusters, AWX eliminates licensing costs in exchange for cluster administration effort, while teams lacking Kubernetes face friction adapting to operator-managed deployments.

What it does well

• Visual workflow DAG builder that chains playbooks, inventory syncs, and approval steps into pipelines with conditional branching on success or failure.
• Role-based access control with granular permissions across organizations, teams, inventories, and templates, integrating with LDAP, SAML, and OAuth2 providers.
• Containerized Execution Environments that isolate Python dependencies and Ansible collections, preventing package version collisions across different teams.
• Comprehensive REST API and browsable documentation, enabling automated job execution and credential injection directly from CI/CD pipelines.