Ansible

Vault Commands

Encrypt sensitive data like passwords, API keys, and certificates. Manage vault passwords and integrate encrypted files into playbooks.

9 commands

Pro Tips

Use '--vault-password-file' with a script that fetches from secret manager.

Encrypt only sensitive variables, not entire files, for easier diffs.

Use 'ansible-vault encrypt_string' for inline encrypted variables.

Common Mistakes

Never commit vault passwords to version control.

Rotate vault passwords periodically and re-encrypt files.

Commands

Run with Vault Password

$ ansible-playbook playbook.yml --ask-vault-pass

Run playbook with vault password prompt

Run with Vault Password File

$ ansible-playbook playbook.yml --vault-password-file=.vault_pass

Run playbook with vault password from file

Create Encrypted File

$ ansible-vault create secrets.yml

Create a new encrypted file

Decrypt File

$ ansible-vault decrypt secrets.yml

Decrypt an encrypted file

Edit Encrypted File

$ ansible-vault edit secrets.yml

Edit an encrypted file in place

Encrypt Existing File

$ ansible-vault encrypt vars.yml

Encrypt an existing file

Encrypt String

$ ansible-vault encrypt_string 'secret_value' --name 'my_secret'

Encrypt a single variable value

Change Vault Password

$ ansible-vault rekey secrets.yml

Change the encryption password

View Encrypted File

$ ansible-vault view secrets.yml

View contents of encrypted file