Protecting sensitive data with Ansible vault

Note

Making Open Source More Inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. We ask that you open an issue or pull request if you come upon a term that we have missed. For more details, see our CTO Chris Wright’s message.

Welcome to the Ansible vault documentation. Ansible vault provides a way to encrypt and manage sensitive data such as passwords. This guide introduces you to Ansible vault and covers the following topics:

• Managing vault passwords.

• Encrypting content and files with Ansible vault.

• Using encrypted variables and files.

• Ansible Vault
• Managing vault passwords
  • Choosing between a single password and multiple passwords
  • Managing multiple passwords with vault IDs
  • Storing and accessing vault passwords
• Encrypting content with Ansible Vault
  • Encrypting individual variables with Ansible Vault
  • Encrypting files with Ansible Vault
• Using encrypted variables and files
  • Passing a single password
  • Passing vault IDs
  • Passing multiple vault passwords
  • Using --vault-id without a vault ID
• Configuring defaults for using encrypted content
  • Setting a default vault ID
  • Setting a default password source
• When are encrypted files made visible?
• Format of files encrypted with Ansible Vault
  • Ansible Vault payload format 1.1 - 1.2