modified to use chef-vault, rather than encrypted data bag