ansible-vault

Create a new encrypted file

$ ansible-vault create [secrets.yml]

$ ansible-vault encrypt [file.yml]

$ ansible-vault decrypt [secrets.yml]

$ ansible-vault edit [secrets.yml]

$ ansible-vault view [secrets.yml]

$ ansible-vault encrypt_string '[secret_value]' --name '[variable_name]'

$ ansible-vault rekey [secrets.yml]

ansible-vault command [--vault-password-file file] [options] files

ansible-vault encrypts sensitive data like passwords, keys, and credentials within Ansible projects. It uses AES256 encryption to protect files while allowing them to be used directly in playbooks.
Encrypted files can be edited, viewed, and used in playbooks without manual decryption; ansible-playbook handles decryption automatically when provided with the vault password.

create file

Create new encrypted file

Encrypt existing files

Decrypt files

Edit encrypted file in place

View encrypted file contents

Encrypt a string for embedding

Change encryption password

File containing vault password

Vault identity label

Prompt for vault password

New password file for rekey

Vault password must be available during playbook runs. Encrypted files should be committed to version control, not the password. Use vault-id for multiple passwords.

ansible-vault was introduced in Ansible 1.5 (2014) to address the need for secure handling of sensitive data in automation. Multiple vault passwords support was added in Ansible 2.4.

ansible-playbook(1), ansible(1), gpg(1)