Follow-up to this Q&A.

According to this and this documentation it should be possible to define a default vault password file by specifying vault_password_file = ~/.vault_pass.txt in one of the following files:

* ANSIBLE_CONFIG (an environment variable)
* ansible.cfg (in the current directory)
* .ansible.cfg (in the home directory)
* /etc/ansible/ansible.cfg

Although the password file exists and the log indicates that the ansible.cfg is used that contains the definition, the decryption fails:

Using /etc/ansible/ansible.cfg as config file
ERROR! Decryption failed on /path/to/ansible/group_vars/production/vault


  • Is the pass correct for this vault?

Yes. When ansible is run using --vault-password-file=~/.vault_pass.txt the decryption succeeds.

  • Just so that we're clear - the name of the environment variable is ANSIBLE_VAULT_PASSWORD_FILE, correct?

No. When this variable is used it works, but the aim is to set it in the ansible.cfg by setting /etc/ansible/ansible.cfg.

  • What Ansible version is used?

    user@host:/dir$ ansible --version
        config file = /etc/ansible/ansible.cfg
        configured module search path = Default w/o overrides
  • Does using a full path in the config works?

The decryption failes as well when the full path instead of ~, i.e. /home/user/.vault_pass.txt was specified.

  • 1
    Just so that we're clear - the name of the environment variable is ANSIBLE_VAULT_PASSWORD_FILE, correct?
    – 13dimitar
    Commented Mar 30, 2017 at 8:18
  • And what's the output of echo $ANSIBLE_VAULT_PASSWORD_FILE?
    – 13dimitar
    Commented Mar 30, 2017 at 10:05
  • it is empty because I try to use vault_password_file = ~/.vault_pass.txt
    – 030
    Commented Mar 30, 2017 at 10:08
  • variable names are case sensitive
    – 13dimitar
    Commented Mar 30, 2017 at 10:16
  • This is set in the ansible.cfg. I am not using an environment variable
    – 030
    Commented Mar 30, 2017 at 11:40

3 Answers 3


I found an issue with Ansible/Python causing a failure to decrypt.

Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using ansible-vault edit -vvvvv) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions.

Upgrading to Python 3.7.3 on Ubuntu (using apt-get install python3.7 on 18.04) fixed this.

Your issue may be different, but if on Python 3.6 or lower, I would try upgrading to 3.7.

  • I can confirm a similar behavior: I started an ansible project using python3.* in a virtual environment on OSX; I then cloned it onto an Ubuntu 20.04LTS machine and started using the vault-keyring-client.py script to pull my vault password from my system keyring, so I didn't have to store it at rest (github.com/ansible-collections/community.general/blob/main/…) I configured it properly, and encrypted and then viewed a file with ansible-vault, but simply viewing or decrypting strings/files encrypted on OSX threw an HMAC verification failure.
    – Life5ign
    Commented May 18, 2021 at 18:29
  • I guess I need to re-encrypt all the files and strings that were originally encrypted on the OSX machine. I am using a pyenv python 3.* in a virtual environment on both machines, so I'm a little confused
    – Life5ign
    Commented May 18, 2021 at 18:31
  • @Life5ign Interesting - which versions of Python are you using on macOS and Ubuntu? If not the same, can you try 3.7 on both? This would help diagnose if it's a Python version issue or macOS vs Ubuntu difference.
    – RichVel
    Commented May 19, 2021 at 5:35

It is unclear why it failed, but setting vault_password_file = ~/.vault_pass.txt in /etc/ansible/ansible.cfg was sufficient.


According to the docs,

You can also set ANSIBLE_VAULT_PASSWORD_FILEenvironment variable, e.g. ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txtand Ansible will automatically search for the password in that file.

Ensures that you are using the exact same case.

  • 1
    You are'missing the question, it is about configuration file property specially, it is stated literally in the question, read it again carefully
    – Tensibai
    Commented Apr 2, 2017 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.