Encrypt variable with Vault

Inline-encrypt a single string value for use in vars

ansible-vault encrypt_string 'mysecretpassword' --name 'db_password'
tool
ansible56 commands
tags
ansiblesecurity

More ansible commands

  • Limit to specific hosts
    ansible-playbook deploy.yml -i inventory.ini --limit 'web01,web02'

    Run playbook only on web01 and web02

  • Step through tasks interactively
    ansible-playbook site.yml -i inventory.ini --step

    Confirm each task before execution (debug mode)

  • Rekey vault file
    ansible-vault rekey vault.yml --new-vault-password-file new_pass.txt

    Re-encrypt vault with a new password without exposing plaintext; rotate secrets safely

  • Multiple vault IDs with prompt
    ansible-playbook site.yml --vault-id dev@dev_pass.txt --vault-id prod@prompt

    Mix vault IDs: file for dev, interactive prompt for prod; lets you stage secrets per env

  • Edit vault in place
    EDITOR=vim ansible-vault edit group_vars/prod/secrets.yml --vault-password-file ~/.vault_pass

    Decrypt, edit in $EDITOR, re-encrypt atomically — never writes plaintext to disk

all 56 ansible commands