You are reading an unmaintained version of the Ansible documentation. Unmaintained Ansible versions can contain unfixed security vulnerabilities (CVE). Please upgrade to a maintained version. See the latest Ansible documentation.

ansible-vault

encryption/decryption utility for Ansible data files

Synopsis 

usage: ansible-vault [-h] [--version] [-v]
                  {create,decrypt,edit,view,encrypt,encrypt_string,rekey}
                  ...

Description 

can encrypt any structured data file used by Ansible. This can include group_vars/ or host_vars/ inventory variables, variables loaded by include_vars or vars_files, or variable files passed on the ansible-playbook command line with -e @file.yml or -e @file.json. Role variables and defaults are also included!

Because Ansible tasks, handlers, and other objects are data, these can also be encrypted with vault. If you’d like to not expose what variables you are using, you can keep an individual task file entirely encrypted.

Common Options 

--version: show program’s version number, config file location, configured module search path, module location, executable location and exit

-h, --help: show this help message and exit

-v, --verbose: Causes Ansible to print more debug messages. Adding multiple -v will increase the verbosity, the builtin plugins currently evaluate up to -vvvvvv. A reasonable level to start is -vvv, connection debugging might require -vvvv.

Actions 

create 

create and open a file in an editor that will be encrypted with the provided vault secret when closed

--ask-vault-password, --ask-vault-pass: ask for vault password

--encrypt-vault-id <ENCRYPT_VAULT_ID>: the vault id used to encrypt (required if more than one vault-id is provided)

--vault-id: the vault identity to use

--vault-password-file, --vault-pass-file: vault password file

decrypt 

decrypt the supplied file using the provided vault secret

--ask-vault-password, --ask-vault-pass: ask for vault password

--output <OUTPUT_FILE>: output file name for encrypt or decrypt; use - for stdout

--vault-id: the vault identity to use

--vault-password-file, --vault-pass-file: vault password file

edit 

open and decrypt an existing vaulted file in an editor, that will be encrypted again when closed

--ask-vault-password, --ask-vault-pass: ask for vault password

--encrypt-vault-id <ENCRYPT_VAULT_ID>: the vault id used to encrypt (required if more than one vault-id is provided)

--vault-id: the vault identity to use

--vault-password-file, --vault-pass-file: vault password file

view 

open, decrypt and view an existing vaulted file using a pager using the supplied vault secret

--ask-vault-password, --ask-vault-pass: ask for vault password

--vault-id: the vault identity to use

--vault-password-file, --vault-pass-file: vault password file

encrypt 

encrypt the supplied file using the provided vault secret

--ask-vault-password, --ask-vault-pass: ask for vault password

--encrypt-vault-id <ENCRYPT_VAULT_ID>: the vault id used to encrypt (required if more than one vault-id is provided)

--output <OUTPUT_FILE>: output file name for encrypt or decrypt; use - for stdout

--vault-id: the vault identity to use

--vault-password-file, --vault-pass-file: vault password file

encrypt_string 

encrypt the supplied string using the provided vault secret

--ask-vault-password, --ask-vault-pass: ask for vault password

--encrypt-vault-id <ENCRYPT_VAULT_ID>: the vault id used to encrypt (required if more than one vault-id is provided)

--output <OUTPUT_FILE>: output file name for encrypt or decrypt; use - for stdout

--show-input: Do not hide input when prompted for the string to encrypt

--stdin-name <ENCRYPT_STRING_STDIN_NAME>: Specify the variable name for stdin

--vault-id: the vault identity to use

--vault-password-file, --vault-pass-file: vault password file

-n, --name: Specify the variable name

-p, --prompt: Prompt for the string to encrypt

rekey 

re-encrypt a vaulted file with a new secret, the previous secret is required

--ask-vault-password, --ask-vault-pass: ask for vault password

--encrypt-vault-id <ENCRYPT_VAULT_ID>: the vault id used to encrypt (required if more than one vault-id is provided)

--new-vault-id <NEW_VAULT_ID>: the new vault identity to use for rekey

--new-vault-password-file <NEW_VAULT_PASSWORD_FILE>: new vault password file for rekey

--vault-id: the vault identity to use

--vault-password-file, --vault-pass-file: vault password file

Environment 

The following environment variables may be specified.

ANSIBLE_CONFIG – Override the default ansible config file

Many more are available for most options in ansible.cfg