Chapter 3. Ansible vault Sometimes your playbook needs to use sensitive data such as passwords, API keys, and other secrets to configure managed hosts. Storing this information in plain text in variables or other Ansible-compatible files is a security risk because any user with access to those files can read the sensitive data. With Ansible vault, you can encrypt, decrypt, view, and edit sensitive information. They could be included as: Inserted variable files in an Ansible Playbook Host and group variables Variable files passed as arguments when executing the playbook Variables defined in Ansible roles You can use Ansible vault to securely manage individual variables, entire files, or even structured data like YAML files. This data can then be safely stored in a version control system or shared with team members without exposing sensitive information. Important Files are protected with symmetric encryption of the Advanced Encryption Standard (AES256), where a single password or passphrase is used both to encrypt and decrypt the data. Note that the way this is done has not been formally audited by a third party. To simplify management, it makes sense to set up your Ansible project so that sensitive variables and all other variables are kept in separate files, or directories. Then you can protect the files containing sensitive variables with the ansible-vault command. Creating an encrypted file The following command prompts you for a new vault password. Then it opens a file for storing sensitive variables using the default editor. Viewing an encrypted file The following command prompts you for your existing vault password. Then it displays the sensitive contents of an already encrypted file. Editing an encrypted file The following command prompts you for your existing vault password. Then it opens the already encrypted file for you to update the sensitive variables using the default editor. Encrypting an existing file The following command prompts you for a new vault password. Then it encrypts an existing unencrypted file. Decrypting an existing file The following command prompts you for your existing vault password. Then it decrypts an existing encrypted file. Changing the password of an encrypted file The following command prompts you for your original vault password, then for the new vault password. Basic application of Ansible vault variables in a playbook --- - name: Create user accounts for all servers hosts: managed-node-01.example.com vars_files: - vault.yml tasks: - name: Create user from vault.yml file user: name: "{{ username }}" password: "{{ pwhash }}" You read-in the file with variables ( vault.yml ) in the vars_files section of your Ansible Playbook, and you use the curly brackets the same way you would do with your ordinary variables. Then you either run the playbook with the ansible-playbook --ask-vault-pass command and you enter the password manually. Or you save the password in a separate file and you run the playbook with the ansible-playbook --vault-password-file /path/to/my/vault-password-file command. Additional resources ansible-vault(1) , ansible-playbook(1) man pages on your system Ansible vault Ansible vault Best Practices

Commands:
ansible-vault create vault.yml New Vault password: <vault_password> Confirm New Vault password: <vault_password>
ansible-vault view vault.yml Vault password: <vault_password> my_secret: "yJJvPqhsiusmmPPZdnjndkdnYNDjdj782meUZcw"
ansible-vault edit vault.yml Vault password: <vault_password>
ansible-vault encrypt vault.yml New Vault password: <vault_password> Confirm New Vault password: <vault_password> Encryption successful
ansible-vault decrypt vault.yml Vault password: <vault_password> Decryption successful
ansible-vault rekey vault.yml Vault password: <vault_password> New Vault password: <vault_password> Confirm New Vault password: <vault_password> Rekey successful
--- - name: Create user accounts for all servers hosts: managed-node-01.example.com vars_files: - vault.yml tasks: - name: Create user from vault.yml file user: name: "{{ username }}" password: "{{ pwhash }}"