Rekey vault file

Re-encrypt vault with a new password without exposing plaintext; rotate secrets safely

ansible-vault rekey vault.yml --new-vault-password-file new_pass.txt
tool
ansible56 commands
tags
ansiblevaultsecretssecurity

More ansible commands

  • Multiple vault IDs with prompt
    ansible-playbook site.yml --vault-id dev@dev_pass.txt --vault-id prod@prompt

    Mix vault IDs: file for dev, interactive prompt for prod; lets you stage secrets per env

  • Edit vault in place
    EDITOR=vim ansible-vault edit group_vars/prod/secrets.yml --vault-password-file ~/.vault_pass

    Decrypt, edit in $EDITOR, re-encrypt atomically — never writes plaintext to disk

  • Dynamic inventory graph
    ansible-inventory -i aws_ec2.yml --graph --vars

    Render dynamic cloud inventory tree with host vars; verify plugin grouping before a run

  • Inventory as YAML
    ansible-inventory -i aws_ec2.yml --list --yaml > resolved_inventory.yml

    Materialize a dynamic inventory to static YAML for diffing or offline debugging

  • Constructed keyed_groups
    plugin: constructed keyed_groups: - key: tags.Role prefix: role - key: placement.region prefix: region

    Auto-build host groups from facts/tags via constructed plugin; e.g. role_web, region_eu

all 56 ansible commands