Ansible Automation Ansible Vault and Secrets Management 1 — Questions and Answers

Question 1: What is the primary purpose of Ansible Vault?

To encrypt sensitive data such as passwords, API keys, and certificates within Ansible files (Correct answer)
To store playbook execution history for auditing
To provide a secure connection tunnel between the control node and managed hosts
To manage SSH key rotation across managed hosts

Correct answer: To encrypt sensitive data such as passwords, API keys, and certificates within Ansible files

Ansible Vault encrypts sensitive content in files or individual strings, allowing secrets to be safely stored in version control.

Ansible Vault is Ansible's built-in encryption feature designed to protect sensitive data. It uses AES-256 encryption to encrypt entire files (like variable files containing passwords) or individual variable values within files. Encrypted content can be safely committed to version control (Git) without exposing sensitive data. Ansible automatically decrypts content at runtime when the vault password is provided. This is essential for managing credentials, API keys, TLS certificates, and other secrets in automated infrastructure pipelines.

Question 2: What command creates a new encrypted Ansible Vault file?

ansible-vault create secrets.yml (Correct answer)
ansible-vault encrypt secrets.yml
ansible-vault new secrets.yml
ansible-vault init secrets.yml

Correct answer: ansible-vault create secrets.yml

'ansible-vault create' opens an editor to create a new file that is encrypted on save.

'ansible-vault create secrets.yml' creates a new encrypted file. Ansible prompts for a vault password (twice for confirmation), then opens your default editor ($EDITOR or vi). When you save and exit, the content is encrypted with AES-256. The resulting file is a YAML-formatted vault file with the header '$ANSIBLE_VAULT;1.1;AES256'. To encrypt an existing plaintext file, use 'ansible-vault encrypt secrets.yml' instead.

Question 3: How do you run a playbook that uses Ansible Vault-encrypted files?

ansible-playbook site.yml --ask-vault-pass (Correct answer)
ansible-playbook site.yml --vault-file secrets.yml
ansible-playbook site.yml --decrypt
ansible-playbook site.yml --vault=true

Correct answer: ansible-playbook site.yml --ask-vault-pass

'--ask-vault-pass' prompts for the vault password interactively at runtime, which is used to decrypt vault-protected content.

To run a playbook using encrypted vault content, provide the vault password using one of these methods: 1. '--ask-vault-pass': Prompts interactively (good for manual runs) 2. '--vault-password-file /path/to/password-file': Reads password from a file (for automation) 3. Setting ANSIBLE_VAULT_PASSWORD_FILE environment variable 4. Configuring 'vault_password_file' in ansible.cfg For CI/CD pipelines, the password file method is preferred. The password file should have restricted permissions (chmod 600) and should not be committed to version control.

Question 4: What is the difference between encrypting an entire file with Ansible Vault versus using 'vault encrypted strings'?

Encrypting entire files protects all content; vault encrypted strings (ansible-vault encrypt_string) encrypt individual values while the rest of the file remains readable (Correct answer)
They use different encryption algorithms
Encrypted strings are more secure than encrypted files
File encryption requires a password but string encryption does not

Correct answer: Encrypting entire files protects all content; vault encrypted strings (ansible-vault encrypt_string) encrypt individual values while the rest of the file remains readable

Vault encrypted strings allow mixing encrypted and plaintext variables in a single file, improving readability while protecting only sensitive values.

'ansible-vault encrypt' encrypts the entire file—nothing is readable without the vault password, including non-sensitive variable names. 'ansible-vault encrypt_string' generates an encrypted string for a specific value that can be embedded in a regular YAML file: db_name: myapp_production db_password: !vault | $ANSIBLE_VAULT;1.1;AES256 38613630... The file remains mostly human-readable, and only sensitive values are encrypted. This approach is preferred for variables files where most values are non-sensitive, and it avoids encrypting entire files unnecessarily.

Question 5: What is Ansible Vault's 'vault-id' feature used for?

It allows multiple vault passwords to be used simultaneously, labeling which password decrypts which content (Correct answer)
It provides a unique identifier for auditing vault access
It specifies which hosts require vault-protected variables
It integrates Ansible Vault with HashiCorp Vault

Correct answer: It allows multiple vault passwords to be used simultaneously, labeling which password decrypts which content

Vault IDs enable multi-password scenarios, where different secrets can be encrypted with different passwords, useful for different environments or teams.

Vault IDs solve the multi-environment secret management problem. You can encrypt files with different passwords and label them: ansible-vault encrypt --vault-id prod@prompt prod_secrets.yml ansible-vault encrypt --vault-id dev@prompt dev_secrets.yml When running playbooks: ansible-playbook site.yml --vault-id prod@prompt --vault-id dev@prompt Ansible automatically uses the correct password for each encrypted file based on the vault ID label. This enables teams to have different passwords for production vs development secrets without re-encrypting when onboarding developers.

Question 6: How do you change the password on an existing Ansible Vault-encrypted file?

ansible-vault rekey secrets.yml (Correct answer)
ansible-vault change-password secrets.yml
ansible-vault update-password secrets.yml
ansible-vault passwd secrets.yml

Correct answer: ansible-vault rekey secrets.yml

'ansible-vault rekey' changes the encryption password on an existing vault file, prompting for the current password and the new one.

'ansible-vault rekey' is used to rotate vault passwords: ansible-vault rekey secrets.yml Ansible prompts for the current vault password, then prompts for the new password (twice). The file is decrypted with the old password and re-encrypted with the new one. This is useful for password rotation security practices. For bulk rekeying, you can pass multiple files: 'ansible-vault rekey file1.yml file2.yml'. With vault IDs, specify '--new-vault-id' to change the associated ID as well.

Ansible Automation Ansible Vault and Secrets Management 1

What is the primary purpose of Ansible Vault?