Ansible Vault and Secrets Management Flashcards

What encryption algorithm does Ansible Vault use by default?

Answer: AES-256 (specifically AES256-CTR with PBKDF2 key derivation)

Ansible Vault uses AES-256 encryption (AES256-CTR mode) with PBKDF2 for key derivation from the vault password.

How can you view the contents of an Ansible Vault-encrypted file without decrypting it permanently?

Answer: ansible-vault view secrets.yml

'ansible-vault view' decrypts and displays the file contents to stdout without writing the decrypted file to disk.

What best practice should be followed when storing Ansible Vault password files on disk?

Answer: The password file should have restricted permissions (mode 0600), be owned by the ansible user, and never be committed to version control

Vault password files must be protected with strict file permissions and should never be stored in version-controlled directories.

Which Ansible Vault command permanently decrypts a vault-encrypted file to plaintext?

Answer: ansible-vault decrypt secrets.yml

'ansible-vault decrypt' decrypts the file in-place, converting it to plaintext YAML on disk—use with caution.

How do you integrate Ansible Vault with an external secrets manager like HashiCorp Vault?

Answer: Use a vault password script that retrieves the password from HashiCorp Vault at runtime via its API

A vault password script dynamically retrieves the Ansible Vault password from HashiCorp Vault at playbook runtime, combining both secret management systems.

What does the 'no_log: true' directive do in an Ansible task?

Answer: It prevents task arguments and output from being logged to stdout and Ansible log files, protecting sensitive data

'no_log: true' prevents sensitive task parameters (like passwords) from appearing in Ansible's verbose output and log files.