The Ansible vault

As you can see from the previous section, many a times, the Ansible variable often provides sensitive information such as username and password. It would be a good idea to put some security measures around the variables so that we can safeguard against these information. The Ansible vault provides encryption for files rather than using plain text.

All Ansible Vault functions start with the ansible-vault command. You can manually create a encrypted file via the create option. You will be asked to enter a password. If you try to view the file, you will find that the file is not in clear text:

$ ansible-vault create secret.yml
Vault password:

$ cat secret.yml
$ANSIBLE_VAULT;1.1;AES256
336564626462373962326635326361323639323635353630646665656430353261383737623<skip>653537333837383863636530356464623032333432386139303335663262
3962

You can later on edit the file via the edit option or view the file via the view option:

$ ansible-vault edit secret.yml 
Vault password:

$ ansible...