What is Ansible Vault and how do you secure secrets?
Learn how Ansible Vault encrypts passwords and keys with AES-256, how to encrypt files or values, and how to supply the vault password at runtime.
Expected Interview Answer
Ansible Vault is a built-in feature that encrypts sensitive data — passwords, API keys, certificates — so secrets can live safely inside playbooks and version control, and are decrypted only at runtime when the correct vault password is supplied.
Vault uses AES-256 symmetric encryption. You can encrypt entire files with ansible-vault encrypt, create new encrypted files with create, or encrypt individual variable values inline using encrypt_string. At execution, you provide the password via --ask-vault-pass, a password file with --vault-password-file, or vault IDs for multiple keys, and Ansible transparently decrypts the data in memory. This keeps plaintext secrets out of Git while still letting playbooks reference them like ordinary variables.
- Store secrets safely in version control
- AES-256 encryption of files or single values
- Decryption happens only at runtime, in memory
- Multiple keys via vault IDs for different environments
- Reference encrypted variables like any normal variable
AI Mentor Explanation
Vault is like the sealed envelope holding the team's secret batting order, locked in the captain's safe until the toss. Anyone can carry the envelope around the ground, but only the captain's key opens it, and it's read out only at the moment of play — never left lying open in the dressing room for rivals to see.
Step-by-Step Explanation
Step 1
Choose what to encrypt
Decide between encrypting a whole file (e.g. group_vars/prod/secrets.yml) or a single value with encrypt_string.
Step 2
Encrypt with the CLI
Run 'ansible-vault encrypt secrets.yml' or 'ansible-vault create newfile.yml'; you'll set a vault password that guards AES-256 encryption.
Step 3
Reference secrets normally
Use the encrypted variables in playbooks exactly like plain variables — Ansible decrypts them at runtime.
Step 4
Supply the password at runtime
Run with --ask-vault-pass, or --vault-password-file secret.txt, or use --vault-id for multiple keys per environment.
Step 5
Manage over time
Use edit, view, and rekey subcommands to update contents or rotate the password without exposing plaintext on disk.
What Interviewer Expects
- Vault encrypts secrets with AES-256
- Can encrypt whole files or single values (encrypt_string)
- Decryption happens only at runtime with the vault password
- Password supplied via --ask-vault-pass or --vault-password-file
- Vault IDs allow multiple keys for different environments
- Awareness of encrypt, decrypt, edit, view, rekey subcommands
Common Mistakes
- Committing plaintext secrets instead of encrypting them
- Confusing Vault with a separate secrets server — it's file encryption
- Storing the vault password in the repo alongside the encrypted file
- Forgetting Vault uses symmetric AES-256, not public-key crypto
- Not using rekey to rotate passwords when a secret is compromised
Best Answer (HR Friendly)
“Ansible Vault is a way to lock up sensitive information like passwords and keys inside your automation files so they can be stored safely, even in shared code. The files stay scrambled until you run the automation and provide the vault password, which unlocks them just long enough to do the job.”
Code Example
# Create a new encrypted file
ansible-vault create group_vars/prod/secrets.yml
# Encrypt an existing file
ansible-vault encrypt secrets.yml
# Edit / view / rotate the password
ansible-vault edit secrets.yml
ansible-vault rekey secrets.yml
# Encrypt a single value inline
ansible-vault encrypt_string 's3cr3t' --name 'db_password'
# Run a playbook and supply the password
ansible-playbook site.yml --ask-vault-pass
ansible-playbook site.yml --vault-password-file ~/.vault_pass.txt- hosts: db
vars_files:
- group_vars/prod/secrets.yml
tasks:
- name: Configure database password
ansible.builtin.template:
src: db.conf.j2
dest: /etc/db/db.conf
# db_password is decrypted at runtime from the vaultFollow-up Questions
- How do you encrypt a single variable instead of a whole file?
- What encryption algorithm does Ansible Vault use?
- How do you supply the vault password non-interactively in CI?
- What are vault IDs and when would you use multiple ones?
- How do you rotate or change a vault password?
- How does Vault compare to tools like HashiCorp Vault?
MCQ Practice
1. What encryption does Ansible Vault use?
Ansible Vault protects data with AES-256 symmetric encryption, unlocked by the shared vault password.
2. Which command encrypts just a single value for inline use?
encrypt_string produces an encrypted representation of one value that can be embedded directly in a vars file.
3. How is the vault password provided during a playbook run?
At runtime you supply the password interactively with --ask-vault-pass or from a file with --vault-password-file so Ansible can decrypt in memory.
Flash Cards
What is Ansible Vault? — A built-in feature that encrypts secrets (files or values) so they're safe in version control and decrypted only at runtime.
What algorithm does Vault use? — AES-256 symmetric encryption, unlocked with the vault password.
How do you encrypt one value? — ansible-vault encrypt_string '<value>' --name '<var>' produces an inline encrypted variable.
How is the password given at runtime? — --ask-vault-pass (interactive) or --vault-password-file <file> (non-interactive, good for CI).
How do you rotate the vault password? — Use ansible-vault rekey <file> to re-encrypt with a new password without exposing plaintext.