Ansible Vault and Secrets Management Flashcards

What is the primary purpose of Ansible Vault?

Answer: To encrypt sensitive data such as passwords, API keys, and certificates within Ansible files

Ansible Vault encrypts sensitive content in files or individual strings, allowing secrets to be safely stored in version control.

What command creates a new encrypted Ansible Vault file?

Answer: ansible-vault create secrets.yml

'ansible-vault create' opens an editor to create a new file that is encrypted on save.

How do you run a playbook that uses Ansible Vault-encrypted files?

Answer: ansible-playbook site.yml --ask-vault-pass

'--ask-vault-pass' prompts for the vault password interactively at runtime, which is used to decrypt vault-protected content.

What is the difference between encrypting an entire file with Ansible Vault versus using 'vault encrypted strings'?

Answer: Encrypting entire files protects all content; vault encrypted strings (ansible-vault encrypt_string) encrypt individual values while the rest of the file remains readable

Vault encrypted strings allow mixing encrypted and plaintext variables in a single file, improving readability while protecting only sensitive values.

What is Ansible Vault's 'vault-id' feature used for?

Answer: It allows multiple vault passwords to be used simultaneously, labeling which password decrypts which content

Vault IDs enable multi-password scenarios, where different secrets can be encrypted with different passwords, useful for different environments or teams.

How do you change the password on an existing Ansible Vault-encrypted file?

Answer: ansible-vault rekey secrets.yml

'ansible-vault rekey' changes the encryption password on an existing vault file, prompting for the current password and the new one.