ansible-vault

ansible-vault command [--vault-password-file file] [options] files

ansible-vault encrypts sensitive data like passwords, keys, and credentials within Ansible projects. It uses AES256 encryption to protect files while allowing them to be used directly in playbooks.Encrypted files can be edited, viewed, and used in playbooks without manual decryption; ansible-playbook handles decryption automatically when provided with the vault password.

create file

Create new encrypted file

Encrypt existing files

Decrypt files

Edit encrypted file in place

View encrypted file contents

Encrypt a string for embedding in a playbook or vars file

Re-encrypt files with a new password

File containing the vault password

Vault identity to use (label plus password source)

Prompt for the vault password

Variable name to assign (encrypt_string only)

Vault id to use when encrypting (when several are provided)

Write output to the named file instead of stdout

Password file holding the new password for rekey

Vault id holding the new password for rekey

/etc/ansible/ansible.cfg

System-wide Ansible configuration, including vault password file path and vault identity settings.

Per-user Ansible configuration overriding system defaults.

Project-level configuration in the current directory, highest priority.

Vault password must be available during playbook runs. Encrypted files should be committed to version control, not the password. Use vault-id for multiple passwords.

ansible-vault was introduced in Ansible 1.5 (2014) to address the need for secure handling of sensitive data in automation. Multiple vault passwords support was added in Ansible 2.4.

ansible-playbook(1), ansible(1), gpg(1)

Source code · Documentation