According the help of ansible-playbook one could use --user=REMOTE_USER to define the ssh user, but one could also define ansible_ssh_user: REMOTE_USER in either the host- or group_vars.


What variable need to be defined in either the group- or host_vars directory to prevent that --vault-password-file has to be defined while running ansible-playbook?


  • When ansible_vault_password_file: ~/.vault_pass.txt is defined in the config the decryption fails:

    ERROR! Decryption failed on /path/to/vault
  • No associated vault variables was found in this documentation


Here is the definition:

DEFAULT_VAULT_PASSWORD_FILE = get_config(p, DEFAULTS, 'vault_password_file', \
'ANSIBLE_VAULT_PASSWORD_FILE', None, value_type='path')

This means that you either put in ansible.cfg or playbook:

vault_password_file: ~/.vault_pass.txt

Or in your shell defined this variable:

export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt
  • I have left the text of the url there intentionally to show people how looking at the code can help where documentation is lacking and where the code can be found easily. But I guess a hyperlink should be enough. – Jiri Klouda Mar 29 '17 at 4:37
  • If anything else fails, read the documentation ... and if there is no documentation, read the source ... if you have access to it ... and if you do, make sure you're looking at the right version ... the only thing left then is to be able to understand it all. PS: links may stop working some day ... – Pierre.Vriens Mar 29 '17 at 7:14
  • @JiriKlouda it does not seem to work although it has been defined in group_vars/all/vars. export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt had to be run. – 030 Mar 30 '17 at 7:30
  • This is a config variable. It has to be in ansible.cfg or equivalent or in the playbook. – Jiri Klouda Mar 30 '17 at 11:44
  • Also I have specifically checked the 2.2 version you run and it is there: github.com/ansible/ansible/blob/stable-2.2/lib/ansible/… – Jiri Klouda Mar 30 '17 at 16:18

You can set an environment variable ANSIBLE_VAULT_PASSWORD_FILE storing the path the the vault password file. This way you won't have the always use the --vault-password-file switch when running a playbook.

This is described in Ansible's Vault documentation, available here.

So, add export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt to your ~/.bash_profile, source from it and you're ready to go.

If you need different vault passwords for different groups of hosts, then you should do the following:

Inside of this subdirectory, create two files named vars and vault. Inside of the vars file, define all of the variables needed, including any sensitive ones. Next, copy all of the sensitive variables over to the vault file and prefix these variables with vault_. You should adjust the variables in the vars file to point to the matching vault_ variables and ensure that the vault file is vault encrypted.

This is an example for best practices approach for managing sensitive information on per group basis. More information is available in Ansible's documentation here (The above text is copied from there).

  • 1
    This won't allow a different password per hosts – Tensibai Mar 29 '17 at 7:44
  • Are you referring to connection password? Because if you do, what does it have in common with Ansible Vault? – 13dimitar Mar 29 '17 at 7:51
  • I was referring to the vault password, willing to have different vault password for different groups makes sense (and is the root of the question as far as I understand it). – Tensibai Mar 29 '17 at 7:54
  • I didn't understand it that way. I've edited my answer to include that scenario. – 13dimitar Mar 29 '17 at 8:01
  • seems better. Btw downvote is not mine – Tensibai Mar 29 '17 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.