Timeline for Where to put ansible-vault password
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 3, 2019 at 14:01 | comment | added | RichVel | Ansible 2.3 introduced a feature that encrypts only the values in YAML files, not the whole file - this is simpler to maintain than the older convention you mention in point 3 at end of this answer. | |
| Jan 30, 2019 at 7:23 | comment | added | RichVel | Good point about storing the Ansible Vault password somewhere more secure (HashiCorp Vault or SaaS vault such as AWS Secrets Manager). However, it still needs to be rotated (changed) if someone leaves the team, as they have had access to it even if briefly. This can be mitigated perhaps by using separate vaults (dev, test, production) i.e. secrets files in YAML. Ansible 2.4+ also lets you specify different passwords for such files using a 'vault ID' - docs page | |
| Feb 28, 2018 at 9:59 | history | edited | Vincenzo Pii | CC BY-SA 3.0 |
fixed ansible syntax in example
|
| Feb 28, 2018 at 7:45 | vote | accept | storm | ||
| Feb 27, 2018 at 21:55 | history | answered | Vincenzo Pii | CC BY-SA 3.0 |