$ ansible-doc -t module cisco.sccfm.change_asa_local_password
> MODULE cisco.sccfm.change_asa_local_password (sccfm-ansible/plugins/modules/change_asa_local_password.py)
Changes the local user password on one or more ASA devices managed
by SCC Firewall Manager.
The module performs a pre-check to confirm the user exists, applies
the password command, and verifies the user is still present
afterward.
Devices can be selected by a Lucene query or by specifying a list of
UIDs.
The query uses the same syntax as the Get Devices API.
See
https://developer.cisco.com/docs/cisco-security-cloud-control-firewall-manager/get-devices/
for query documentation.
OPTIONS (= indicates it is required):
- api_token API token for SCCFM.
set_via:
env:
- name: SCCFM_API_TOKEN
default: null
no_log: true
type: str
- limit Maximum number of devices to return when using `query'.
Ignored when using `uids'.
default: 50
type: int
= new_password The new password to set for the user.
no_log: true
type: str
- offset Pagination offset when using `query'.
Ignored when using `uids'.
default: 0
type: int
- query Lucene query to filter ASA devices.
Mutually exclusive with `uids'.
The query is automatically combined with `deviceType:ASA'.
default: null
type: str
- region SCCFM region (int, us, eu, apj, au, uae, in, or ci).
set_via:
env:
- name: SCCFM_REGION
default: null
type: str
- uids List of device UIDs to target.
Mutually exclusive with `query'.
default: null
elements: str
type: list
= username The local ASA username whose password will be changed.
type: str
AUTHOR: Cisco SCCFM Team
EXAMPLES:
# Example 1: Change password on ASAs matching a query
- name: Change admin password on branch ASAs
cisco.sccfm.change_asa_local_password:
query: "name:branch-* AND connectivityState:ONLINE"
username: admin
new_password: "{{ vault_new_asa_password }}"
region: "{{ sccfm_region }}"
api_token: "{{ sccfm_api_token }}"
register: password_results
# Example 2: Change password on specific devices by UID
- name: Change admin password on specific ASAs
cisco.sccfm.change_asa_local_password:
uids:
- "12345678-1234-1234-1234-123456789abc"
- "87654321-4321-4321-4321-cba987654321"
username: admin
new_password: "{{ vault_new_asa_password }}"
register: password_results
# Example 3: Using module_defaults (recommended)
- name: Change passwords
hosts: localhost
gather_facts: false
module_defaults:
group/cisco.sccfm.all:
region: "{{ sccfm_region }}"
api_token: "{{ sccfm_api_token }}"
tasks:
- name: Change admin password on all online ASAs
cisco.sccfm.change_asa_local_password:
query: "connectivityState:ONLINE"
username: admin
new_password: "{{ vault_new_asa_password }}"
register: password_results
- name: Show results
ansible.builtin.debug:
msg: "{{ item.device_uid }}: {{ item.status }} - {{ item.message }}"
loop: "{{ password_results.results }}"
loop_control:
label: "{{ item.device_uid }}"
RETURN VALUES:
- results List of password change results, one per target device.
elements: dict
returned: success
type: list
contains:
- device_uid The UID of the device.
type: str
- message Human-readable description of the outcome.
type: str
- status The outcome of the password change attempt. One of
success, failed, or user_not_found.
type: str