CertGrid CertGrid
Hands-on Lab·Ansible

Ansible Vault for Secrets

Vault encrypts files with AES256 so that variables containing passwords can live in the same repository as everything else. It is one command to encrypt, one flag to use, and the encrypted file behaves like any other vars file. This covers the whole lifecycle including the two things people miss: no_log, and what happens when you forget the password.

Templates, Files and Vault Guide 21 of 45 Intermediate

An encrypted file starts with $ANSIBLE_VAULT;1.1;AES256, which makes it recognisable to file and to git. There is no password recovery - the key is the password, and losing it means the contents are gone. Vault protects against a repository being read; it does nothing about a running process, since Ansible must decrypt to use the value.

Vault is entirely a control-node concern; the managed node only appears to prove the decrypted value reaches a task.
Server NameIP AddressOSRolesCPURAMHDD
ANS-CTL01192.168.0.36Ubuntu 26.04 LTSAnsible Control Node2 Core3 GB50 GB
ANS-A01192.168.0.37Ubuntu 26.04 LTSManaged Node (group: web)2 Core3 GB50 GB

This guide includes

Use this when a variable file holds a password. This matters because Vault encrypts with AES256 so the file can live in Git - and encrypting a single string instead keeps the rest of the file readable in review.

Before you start

  1. The configuration this guide assumes

  2. A secret in plain text

  3. Encrypt it

  4. Reading it without decrypting the file

  5. Using it in a play

  6. Encrypting a single string

  7. Changing the password

Official sources

← All Ansible guides