---
title: "Secure Your Secrets With Ansible Vault"
description: "Make sure your playbook and environment secrets are secure with the Ansible Vault and level up your playbooks in this ATA Learning tutorial!"
canonical: "https://adamtheautomator.com/ansible-vault/"
---

# Secure Your Secrets With Ansible Vault

> Make sure your playbook and environment secrets are secure with the Ansible Vault and level up your playbooks in this ATA Learning tutorial!

Source: https://adamtheautomator.com/ansible-vault/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Secure Your Secrets With Ansible Vault](https://adamtheautomator.com/wp-content/uploads/2022/05/Secure-Your-Secrets-With-Ansible-Vault.jpg)

# Secure Your Secrets With Ansible Vault

[![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)25 May 20228 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[Ansible](/tag/ansible/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [Configuring the Default Ansible Vault Editor](#configuring-the-default-ansible-vault-editor)
*   [Creating and Encrypting Your First Ansible Vault](#creating-and-encrypting-your-first-ansible-vault)
*   [Encrypting Existing Files](#encrypting-existing-files)
*   [Decrypting Data from Ansible Vault](#decrypting-data-from-ansible-vault)
*   [Updating the Ansible Vault’s Password](#updating-the-ansible-vaults-password)
*   [Using Secured Data in Playbooks and Modules](#using-secured-data-in-playbooks-and-modules)
*   [Using Ansible Vault with a Password File](#using-ansible-vault-with-a-password-file)
*   [Conclusion](#conclusion)

Keeping your secrets from falling into the wrong hands is a top priority. But how exactly do you secure your secrets? Save it on a local text file? Without encryption, that option is too risky. Why not use Ansible Vault to encrypt your variables and files?

In this tutorial, you’ll learn how to secure sensitive content, such as your passwords or keys, with Ansible Vault.

Read on and keep prying eyes off your secrets!

## Prerequisites

This tutorial will be a hands-on demonstration. If you’d like to follow along, be sure you have the following.

*   A Linux machine – This tutorial uses Ubuntu 20.04, but any Linux distribution will work.

Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/)

*   Ansible installed on your machine.

Related:[Guide: How to Setup Ansible](https://adamtheautomator.com/install-ansible/)

## **Configuring the Default Ansible Vault Editor**

As a system administrator, you might be working on various Ansible playbooks containing different servers’ usernames and passwords. You can’t commit these files to the version control system in plain text format because it’s unsecured. And for that reason, Ansible Vault comes in handy.

Ansible Vault is designed to be integrated into your existing workflow to store your data in an encrypted file. But before creating your first Ansible Vault, you’ll have to set your default Ansible Vault editor.

1\. Open your terminal and SSH to your machine.

Related:[How to SSH into Docker Containers \[Step-by-Step\]](https://adamtheautomator.com/ssh-into-docker-container/)

2\. Next, open the _~/.bashrc_ file using a text editor. The _~/.bashrc_ file is a shell script that runs whenever a new terminal session starts. This shell script initializes an interactive shell session and defines environment variables.

3\. Add the following line at the end of the _~/.bashrc_ file, save the changes and exit the editor.

This line sets the EDITOR variable for the currently logged-in user. The EDITOR variable ensures your preferred text editor is used every time you open a new terminal session.

You can set any other text editor you prefer, but this tutorial uses the nano text editor.

```bash
export EDITOR=nano
```

![Setting the Default Text Editor](https://adamtheautomator.com/wp-content/uploads/2022/05/image-38.png)

Setting the Default Text Editor

4\. Finally, run the following commands to apply the changes ([source](https://www.geeksforgeeks.org/source-command-in-linux-with-examples/)) without logging out and back in again, and print (echo) your system’s current default text editor.

```bash
# Loads the environment variable into your current shell session.
source ~/.bashrc
# Prints your system’s current default text editor.
echo $EDITOR
```

Verify that the EDITOR variable is set to your preferred editor, as shown below.

![Applying and Verifying Changes](https://adamtheautomator.com/wp-content/uploads/2022/05/image-39.png)

Applying and Verifying Changes

## **Creating and Encrypting Your First Ansible Vault**

You’ve set your default vault editor, so it’s time to create your first vault. You’ll create and encrypt a file that contains sensitive information, such as usernames, passwords, secret access keys, etc.

You’ll be running the [ansible-vault](https://docs.ansible.com/ansible/latest/cli/ansible-vault.html) command, the main interface for interacting with Ansible Vaults.

1\. Run the following command to create the _secret.yml_ file. Ansible uses YAML, a more human-readable format compared to other data formats like JSON.

```bash
ansible-vault create secret.yml
```

You’ll be prompted to enter and confirm a password for the file. You’ll use this password to encrypt and decrypt the file _secret.yml_ file later, so be sure to choose a strong password you can remember.

![Creating the secret.yml File with a Password](https://adamtheautomator.com/wp-content/uploads/2022/05/image-40.png)

Creating the _secret.yml_ File with a Password

2\. After setting the vault’s password, your default text editor opens an empty file. Enter sensitive information you like to store in the file, save it and close the editor.

This tutorial stores the aws\_access\_key and aws\_secret\_key variables in the _secret.yml_ file. At this point, Ansible encrypts the _secret.yml_ file, and no one else can read the vault’s content unless they know the vault’s password.

![Providing Sensitive Information (secrets)](https://adamtheautomator.com/wp-content/uploads/2022/05/image-41.png)

Providing Sensitive Information (secrets)

3\. Run the cat command to try to view the contents of the _secret.yml_ file without the password.

```bash
cat secret.yml
```

You can verify the file’s content is encrypted if you see random numbers, as shown below. The $ANSIBLE\_VAULT;1.1;AES256 header at the top of the file indicates that the file is encrypted with Ansible Vault using the [AES256](https://www.atpinc.com/blog/what-is-aes-256-encryption) cipher.

The Advanced Encryption Standard(AES) is a symmetric-key algorithm that uses the same key to encrypt and decrypt data.

![Viewing the secret.yml file Without the Vault’s Password](https://adamtheautomator.com/wp-content/uploads/2022/05/image-42.png)

Viewing the _secret.yml_ file Without the Vault’s Password

## Encrypting Existing Files

You’ve created a file from scratch which is automatically encrypted. But how about encrypting existing files? Ansible also offers the [encrypt](https://docs.ansible.com/ansible/latest/user_guide/vault.html#encrypting-existing-files) sub-command to encrypt a specified file. To see how to encrypt an existing file, you’ll encrypt a specific file that contains Ansible variables.

Run the following command to encrypt a file (`vars.yml`).

```bash
ansible-vault encrypt vars.yml
```

Like when you created the _secret.yml_ file the first time, you’ll be prompted to provide a password for the _vars.yml_ file.

The default editor will not open this time because the _vars.yml_ file already exists. Instead, you’ll get the **Encryption successful** message indicating Ansible encrypted the file, as shown below.

![Encrypting an Existing File (vars.yml)](https://adamtheautomator.com/wp-content/uploads/2022/05/image-43.png)

Encrypting an Existing File (_vars.yml_)

Now, run the cat command below to verify Ansible encrypted the _vars.yml_ file.

```bash
cat vars.yml
```

![Verifying Encrypted Existing File](https://adamtheautomator.com/wp-content/uploads/2022/05/image-44.png)

Verifying Encrypted Existing File

## **Decrypting Data from Ansible Vault**

You’ve seen how to encrypt files, making them secure. But when you need to view your files’ content, how do you decrypt your files? Decrypting a file is useful when you want to edit an encrypted file or read its contents without providing the password every time. And Ansible’s [decrypt](https://docs.ansible.com/ansible/latest/user_guide/vault.html#decrypting-encrypted-files) sub-command will come in handy.

1\. Run the following command to decrypt the secret.yml file.

> _The decrypt sub-command takes the path of an encrypted file as its only argument._

```bash
ansible-vault decrypt secret.yml
```

Provide the password for the file, and the file’s contents will be decrypted and written to the disk in plain text.

![Decrypting File Data](https://adamtheautomator.com/wp-content/uploads/2022/05/image-45.png)

Decrypting File Data

2\. Next, run the cat command to view the decrypted content of the _secret.yml_ file.

```bash
cat secret.yml
```

You can see below the content of the _secret.yml_ file printed to the terminal without any encryption. At this point, you can add, edit, or delete any lines in the file to your heart’s content.

![file to your heart’s content](https://adamtheautomator.com/wp-content/uploads/2022/05/image-46.png)

file to your heart’s content

3\. Lastly, run the below command to encrypt the secret.yml file and provide a password to keep the file’s content secure.

```bash
ansible-vault encrypt secret.yml
```

![Encrypting a Decrypted File (secret.yml)](https://adamtheautomator.com/wp-content/uploads/2022/05/image-47.png)

Encrypting a Decrypted File (_secret.yml_)

## **Updating the Ansible Vault’s Password**

You’ve seen that you need to enter a password each time you encrypt and decrypt files. But perhaps, you only want to update the file’s password without decrypting the file. If so, you’ll need to use the `rekey` sub-command. This sub-command lets you change your file’s password at will.

Run the following command to update the password for the `secret.yml` file.

> _The rekey sub-command takes the path of an encrypted file as its only argument._

```bash
ansible-vault rekey secret.yml
```

Provide the current password for the file followed by the new password, as shown below.

At this point, the old password will no longer work to decrypt the file.

![Updating Ansible Vault’s Password](https://adamtheautomator.com/wp-content/uploads/2022/05/image-48.png)

Updating Ansible Vault’s Password

Now, run the command below to try and decrypt the `secret.yml`.

```bash
ansible-vault decrypt secret.yml
```

Provide the old password when prompted, and you’ll see an error message saying the **Decryption failed**, as shown below. This output confirms the password for the file has been successfully updated.

![Verifying New Password is in Effect](https://adamtheautomator.com/wp-content/uploads/2022/05/image-49.png)

Verifying New Password is in Effect

## Using Secured Data in Playbooks and Modules

You’ve seen that running commands to encrypt and decrypt files work. But if you plan to automate the process securely for your application, you’ll need to use playbooks and modules.

1\. Open the Ansible configuration file (_~/.ansible.cfg_) in your editor, which contains the settings for Ansible.

Copy and paste the following code at the end of the _~/.ansible.cfg_ file, save the changes, and close the editor. This code tells Ansible to look for the inventory file (_~/.ansible-hosts)_.

```bash
[defaults]
hostfile = ~/.ansible-hosts
```

2\. Next, open the _~/.ansible-hosts_ file, which contains the inventory of hosts that your Ansible manage node can manage.

Populate the _~/.ansible-hosts_ file with the following line of code, save the changes and close the file. This code tells Ansible that it can manage the localhost via the local connection type.

```bash
localhost ansible_connection=local
```

3\. Run the below command to create a new encrypted file. You can name the file anything, but the file is named helloworld.yml in this tutorial.

```bash
ansible-vault create helloworld.yml
```

![Creating Ansible Playbook (helloworld.yml)](https://adamtheautomator.com/wp-content/uploads/2022/05/image-50.png)

Creating Ansible Playbook (_helloworld.yml_)

Populate the code below to the _helloworld.yml_ file, save the changes and close the editor.

This code is a basic Ansible playbook that prints the hello world message on all the hosts in your inventory. The — symbol at the top of the code block denotes the start of a YAML document.

```bash
---

- hosts: all # Sets to perform the task to all hosts in the inventory 
  tasks: # Sets the tasks to perform
    - shell: echo 'hello world' # Prints a 'hello world' message
```

4\. Finally, run the ansible-playbook command below followed by the –ask-vault-pass options to execute the helloworld.yml playbook on all the hosts in your inventory.

```bash
ansible-playbook --ask-vault-pass helloworld.yml
```

Provide the password for the _helloworld.yml_ file when prompted. As you can see below, your playbook run has been successful.

*   **ok=2** – indicates that both of your tasks have been run successfully.
    
*   **changed=1** – indicates that your task has made one change to the state of your system. In this case, it wrote a hello world message to the shell.
    
*   unreachable and failed are both 0 – indicates no hosts were unreachable or failed during the run.
    

![Running your playbook](https://adamtheautomator.com/wp-content/uploads/2022/05/image-51.png)

Running your playbook

## **Using Ansible Vault with a Password File**

While manually entering a password when running one-off tasks works, it’s not practical for real-world usage.

A better way to provide the password for encrypting and decrypting files is to use a password file. This way, you can store the password in a secure location, and Ansible will read the password from the file needed.

1\. Run the below command to store the Ansible Vault password in a file called _.vault\_pass_. Replace my\_vault\_password with your actual vault password.

```bash
echo 'my_vault_password' > .vault_pass
```

2\. Next, run each command below to change ownership ([chown](https://linuxize.com/post/linux-chown-command/)) of the file to root and change permissions of the _.vault\_pass_ file. These commands ensure that only you (the root user) can read and write on the file.

```bash
# Change ownership of the file to root user
chown root:root .vault_pass
# Change file permissions to root only (read and write permissions)
chmod 700 .vault_pass
```

Related:[Manage Directory and File Permissions with chmod Recursive](https://adamtheautomator.com/chmod-recursive/)

3\. Lastly, run the ansible-playbook command below, followed by the –vault-password-file option to execute a playbook (helloworld.yml) using a password file (_.vault\_pass_).

```bash
ansible-playbook --vault-password-file=.vault_pass helloworld.yml
```

Notice below that Ansible executed the playbook without asking for the encrypted file’s password.

![Running Playbook using a Password File](https://adamtheautomator.com/wp-content/uploads/2022/05/image-52.png)

Running Playbook using a Password File

## Conclusion

In this tutorial, you have learned how to use Ansible Vault to encrypt and decrypt sensitive data for Ansible playbooks and tasks. You’ve stored the Ansible Vault password in a secure location using a password file. This behavior comes in handy for less user intervention when executing a playbook.

With this newfound knowledge, you can now confidently encrypt sensitive data and share your playbooks with others without worrying about the security of your data.

If you use [LastPass](https://www.lastpass.com/) for password management, why not [store your Ansible Vault password in LastPass](https://streamhacker.com/2020/02/24/using-lastpass-with-ansible-vault/) and have Ansible automatically retrieve it when needed?

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fansible-vault%2F&text=Secure%20Your%20Secrets%20With%20Ansible%20Vault)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fansible-vault%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fansible-vault%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2022/05/Manage-Playbooks-and-Inventories-Easily-with-Ansible-Tower.jpg)

### [Ansible Tower Basics for Easy Playbook and Inventory Management](/ansible-tower/)

Master Ansible Tower for effortless playbook and inventory management, elevating your automation skills to the next level with practical, user-friendly strategies.

![](https://adamtheautomator.com/wp-content/uploads/2022/08/How-to-Manage-Services-With-the-Ansible-Service-Module.jpg)

### [How to Manage Services With the Ansible Service Module](/ansible-service/)

Learn how to manage, control, and integrate OS services with the Ansible Service module in this ATA Learning tutorial!

![](https://adamtheautomator.com/wp-content/uploads/2022/05/Discovering-the-Ansible-Hosts-File.jpg)

### [Discovering the Ansible Hosts File](/ansible-hosts-file/)

Discover and learn best practices for managing inventory with the Ansible Hosts File in this tutorial from ATA Learning.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)