Ansible Vault: Encrypt Secrets Safely

Why Ansible Vault?

Hardcoding passwords in playbooks is a security risk. Ansible Vault encrypts sensitive data so you can safely commit it to version control.

Create an Encrypted File

ansible-vault create secrets.yml

Enter a vault password when prompted. The file opens in your editor — add your secrets:

db_password: "SuperSecret123"
api_key: "sk-abc123def456"

Save and close. The file is now AES-256 encrypted.

View and Edit

# View without editing
ansible-vault view secrets.yml

# Edit in place
ansible-vault edit secrets.yml

Encrypt an Existing File

ansible-vault encrypt vars/production.yml

Decrypt it back:

ansible-vault decrypt vars/production.yml

Encrypt a Single Variable

For inline encryption without encrypting the whole file:

ansible-vault encrypt_string 'SuperSecret123' --name 'db_password'

Output:

db_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  6231326536613163...

Paste this directly into your vars file. The rest of the file stays readable.

Use in Playbooks

Reference vault variables like any other variable:

- name: Configure database
  hosts: db_servers
  vars_files:
    - secrets.yml
  tasks:
    - name: Set database password
      ansible.builtin.lineinfile:
        path: /etc/myapp/db.conf
        regexp: '^password='
        line: "password={{ db_password }}"

Run with the vault password:

ansible-playbook site.yml --ask-vault-pass

# Or use a password file
ansible-playbook site.yml --vault-password-file ~/.vault_pass

Multiple Vault Passwords

Use vault IDs for different environments:

# Create with an ID
ansible-vault create --vault-id prod@prompt secrets-prod.yml
ansible-vault create --vault-id dev@prompt secrets-dev.yml

# Run with multiple vault IDs
ansible-playbook site.yml \
  --vault-id prod@~/.vault_pass_prod \
  --vault-id dev@~/.vault_pass_dev

CI/CD Integration

Store the vault password as a CI secret and write it to a temp file:

# GitHub Actions example
- name: Run playbook
  env:
    VAULT_PASS: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
  run: |
    echo "$VAULT_PASS" > /tmp/.vault_pass
    ansible-playbook site.yml --vault-password-file /tmp/.vault_pass
    rm /tmp/.vault_pass

Best Practices

• Never commit vault passwords to Git — use CI/CD secrets or a password manager
• Use encrypt_string for individual values so the file structure stays readable
• Rotate vault passwords periodically — re-encrypt with ansible-vault rekey
• Use vault IDs to separate production and development secrets
• Add .vault_pass to .gitignore as a safety net

Related Posts

• Ansible Automation in Minutes for getting started
• Terraform Security Practices for IaC secrets management
• Securing Your OpenClaw Agent for agent security

---

Ready to go deeper? Check out our hands-on course: Ansible Quickstart — practical exercises you can follow along on your own machine.