Ansible doesn't necessarily need ssh or a central control node, just a place to store roles as artifacts, such as Artifactory or a storage bucket. Pass all of

Ansible doesn't necessarily need ssh or a central control node, just a place to store roles as artifacts, such as Artifactory or a storage bucket. Pass all of your variables and dependencies (role artifact urls, python requirements.txt, etc) to machines through user data and have the machine download the dependencies and run ansible-playbook to configure itself. Optionally, add a systemd timer to run it on a schedule and you have an "agent". I've done it this way a large percentage of the time using ansible. The other way is by baking images and using ansible as the provisioner (using ssh but only during the image build).