# Ansible - Encrypting Sensitive Data with Vault

Ansible Vault is a feature within Ansible that allows you to keep sensitive data such as passwords, API keys, and certificates encrypted within your playbooks. This ensures that your sensitive information is not exposed in plaintext.

**<mark>Step 1: Test Connection to Hosts</mark>**

First, ensure you can connect to your hosts using Ansible:

```plaintext
ansible all -i inventory.ini -m ping
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723842106066/d31e3914-2223-4ae9-a4a4-0431026e816c.png align="center")

**<mark>Step 2: Create a Vault File</mark>**

Next, create a YAML file to store your sensitive data:

```plaintext
vi vault.yaml
```

Add your variables (e.g., `username` and `password`) inside this file:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723841978520/bfb4e3ff-c632-4f50-93a3-91fcc533921a.png align="center")

You can check the content of the file with:

```plaintext
cat vault.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723842853254/5186070f-3674-4d05-9211-01adbc9c5595.png align="center")

**<mark>Step 3: Create a Playbook</mark>**

Create a playbook (`pass.yaml`) that references the vault file:

```plaintext
vi pass.yaml
```

Include the following content in your playbook:

```plaintext
- hosts: all
  remote_user: ubuntu
  become: yes
  vars_files:
    - vault.yaml

  tasks:
    - name: Trying out echo command
      debug:
        msg: "Hello my username is {{ username }} & pass is {{ password }}"
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723843552323/0f119b3c-3647-4aba-9284-ef1d3cb85279.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723843752231/d9d69a98-b6cc-454c-b66a-979386566dda.png align="center")

**<mark>Step 4: Run the Playbook</mark>**

Run the playbook to verify that it works with the variables from the vault file:

```plaintext
 ansible-playbook -i inventory.ini pass.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723844108305/db37be10-ec46-41ca-b55c-5f1f676aee0a.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723844191232/1c086f65-7b5e-4c9c-8910-31e7c8ab41e7.png align="center")

**<mark>Step 5: Encrypt the Vault File</mark>**

To protect your sensitive data, encrypt the `vault.yaml` file:

```plaintext
ansible-vault encrypt vault.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723842962319/fb884c3d-94de-4a48-bec4-47d925aca656.png align="center")

You can check that the file is encrypted by running:

```plaintext
cat vault.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723843041136/bd892034-33ce-456a-b8c7-24bf130d0b77.png align="center")

**<mark>Step 6: Run the Playbook with Encrypted Vault</mark>**

Even with the vault file encrypted, you can still run your playbook as usual:

```plaintext
 ansible-playbook -i inventory.ini pass.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723844304506/a8dc8fe6-06c6-400b-a7f2-1b9c00bd95bf.png align="center")

**Alternatively,** if you want to be prompted for the vault password at runtime, use:

```plaintext
ansible-playbook -i inventory.ini pass.yaml --ask-vault-password
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723844384670/8d80126f-ea64-4bd6-9525-3e3b3ada783d.png align="center")

**<mark>Step 7: View the Encrypted Vault</mark>**

If you need to view the contents of the encrypted vault, use:

```plaintext
ansible-vault view vault.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723844513657/3a229560-f55b-4782-a1a9-11f6d4de0435.png align="center")

**<mark>Step 8: Decrypt the Vault File</mark>**

To decrypt the vault file, run:

```plaintext
ansible-vault decrypt vault.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723844596050/219bb3cf-270d-4272-82b4-dc6cab81b274.png align="center")

Finally, verify the decryption by checking the content of the file:

```plaintext
cat vault.yaml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1723844649362/ff8d4bff-dab4-477f-ad5b-e0f0d77809f7.png align="center")

### **Conclusion**

Following these steps, you can effectively use Ansible Vault to manage and secure sensitive data in your playbooks.