<p>You can create Chef data bags in two ways - by loading it from a json file on your disk, or by creating a new data bag which you then write content into (the two commands in the <a href="https://docs.chef.io/data_bags.html#using-knife" rel="nofollow noreferrer">doc</a>).</p>

<p>Encrypted data bags are stored on the server, and anyone who wants to read them (a workstation or node) needs to download and decrypt it with the secret key that you pass directly or from a file (see the command flags <a href="https://docs.chef.io/data_bags.html#knife-options" rel="nofollow noreferrer">here</a>).</p>

<p>Once you have stored your content (your secret key from openssl) in data bags, you can access them in recipes with <code>data_bag_item(bag_name, item, secret)</code> (again, see the <a href="https://docs.chef.io/dsl_recipe.html#data-bag-item" rel="nofollow noreferrer">docs</a> for sample code).</p>

<p>Hope this helps!</p>

CC BY-SA 3.0
2017-05-16T11:25:48.033Z
The [`data_bag_item`](https://docs.chef.io/dsl_recipe.html#data-bag-item) in recipes DSL is the prefered way, it works with or without encryption, where your direct class access will fail on a clear text data bag (a pain to test then)
Tensibai
CC BY-SA 3.0
2017-05-16T12:09:49.680Z
@Tensibai True, but EncryptedDataBagItem will work because OP specified storing secrets, and that *has* to be encrypted.
grumpyops
CC BY-SA 3.0
2017-05-16T12:15:35.373Z
It is just code smell to call a class instead of using its DSL helper. I assume you don't write recipes with `Chef::Resource::File.new('whatever') do |fres|` but instead you do `file 'whatever' do`... that's the same thing here.
Tensibai
CC BY-SA 3.0
2017-05-16T13:09:23.120Z
@Tensibai thanks for that, TIL. I've updated the answer, you learn something new every day :D
grumpyops
CC BY-SA 3.0
2017-05-16T11:15:23.063Z
2017-05-16T13:37:11.957Z
2017-05-16T13:37:11.957Z
grumpyops
<p>I'm using the following ruby script to encrypt/decrypt chef data bags locally:
<a href="https://gist.github.com/anonymous/4923ebeee53fe4d43a1cfb70a2abaadd" rel="nofollow noreferrer">https://gist.github.com/anonymous/4923ebeee53fe4d43a1cfb70a2abaadd</a></p>

<p>to encrypt:</p>

<p><code>ruby encrypt.rb PATH_TO_SECRET_FILE &lt; UNECRYPTED_DATA_BAG.json &gt; ENCRYPTED_DATA_BAG.json</code></p>

<p>and to decrypt:</p>

<p><code>ruby decrypt.rb PATH_TO_SECRET_FILE &lt; ENCRYPTED_DATA_BAG.json &gt; DECRYPTED_DATA_BAG.json</code></p>

CC BY-SA 3.0
2017-05-11T12:43:25.760Z
What the interest over knife built in commands ?
Tensibai
CC BY-SA 3.0
2017-05-11T17:45:22.313Z
yes I do have a file encrypt.rb file. if I encrypt it above procedure don't I need a secret file to decrypt it.@eyalzek
Sam
CC BY-SA 3.0
2017-05-13T18:27:11.880Z
@Tensibai AFAIK knife commands are only relevant when you have a chef server and not for encrypting/decrypting JSON files locally (which is what I understood OP is interested in).
eyalzek
CC BY-SA 3.0
2017-05-13T18:29:13.933Z
@Sam you need to generate the secret file, in the 2nd tutorial you linked to this is explained in the first paragraph using `openssl`: ```Create a random encryption key:
openssl rand -base64 512 | tr -d '\r\n' > secret_key ```
eyalzek
CC BY-SA 3.0
2017-05-13T18:29:59.883Z
Since chef 12.18 (I think) you can use knife-zero to build on disk databags.  But I misunderstood the goal of your script indeed,  sorry for that
Tensibai
CC BY-SA 3.0
2017-05-11T10:27:12.110Z
2017-05-11T10:27:12.110Z
eyalzek
<p>A data bag is stored on the chef server itself. My chef days are behind me, but you should be able to enter the data bag content either at the create step or the edit one.</p>

<p>For the step 2, just execute the command that you copied:</p>

<pre><code>knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key
</code></pre>

CC BY-SA 3.0
2017-05-10T03:24:49.250Z
Thanks, I would like to ask is there any way that I can create databag independent to chef server. I mean creating databag locally @Michael
Sam
CC BY-SA 3.0
2017-05-10T03:52:03.540Z
Once again my chef skills are a little out of date so I can't pinpoint you to the exact location, but once you find it, you can follow this part of the tutorial to create the databags manually: https://docs.chef.io/data_bags.html#manually
Michael Pereira
CC BY-SA 3.0
2017-05-10T12:31:44.877Z
@Sam you can have local databags as test fixtures in kitchen.  There should be a way to make it work with chef-zero too, but I haven't played with that at all.
chicks
CC BY-SA 3.0
2017-05-10T02:37:09.327Z
2017-05-10T02:37:09.327Z
Michael Pereira
<p>I am very new to <a href="/questions/tagged/chef" class="post-tag" title="show questions tagged &#39;chef&#39;" rel="tag">chef</a> and trying to secure passwords using databags. Unfortunately, I tried in different ways but unable to succeed. I followed different tutorials <a href="https://docs.chef.io/data_bags.html#encrypt-a-data-bag-item" rel="nofollow noreferrer">first</a> and <a href="https://www.devops.zone/provisioning/creating-encrypted-databag-chef/" rel="nofollow noreferrer">second</a>. I understood only two steps but later on I was unable to move forward. </p>

<ol>
<li>I created secret key using openssl</li>
<li>In link1 step 2 says <code>knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key</code>
but I don't know where it is creating the databag.</li>
</ol>

<p>Can some one guide me from step two? I am trying to secure my database password. I got stuck after creating secret file. </p>

CC BY-SA 3.0
2017-05-11T12:00:26.183Z
Take the tour at https://learn.chef.io that sounds like a basis misconception
Tensibai
<chef>
Unable to create databags in chef
Sam
# Unable to create databags in chef

(Asked by: username_0 on 2017-05-09)

I am very new to [chef](/questions/tagged/chef "show questions tagged 'chef'") and trying to secure passwords using databags. Unfortunately, I tried in different ways but unable to succeed. I followed different tutorials [first](https://docs.chef.io/data_bags.html#encrypt-a-data-bag-item) and [second](https://www.devops.zone/provisioning/creating-encrypted-databag-chef/). I understood only two steps but later on I was unable to move forward.

1. I created secret key using openssl
2. In link1 step 2 says `knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key`
   but I don't know where it is creating the databag.

Can some one guide me from step two? I am trying to secure my database password. I got stuck after creating secret file.

**Tags:** chef

> **Comments:**
> **username_1**: Take the tour at https://learn.chef.io that sounds like a basis misconception  

---

## 3 answers

### Answer by username_2 on 2017-05-16. Score: 2

You can create Chef data bags in two ways - by loading it from a json file on your disk, or by creating a new data bag which you then write content into (the two commands in the [doc](https://docs.chef.io/data_bags.html#using-knife)).

Encrypted data bags are stored on the server, and anyone who wants to read them (a workstation or node) needs to download and decrypt it with the secret key that you pass directly or from a file (see the command flags [here](https://docs.chef.io/data_bags.html#knife-options)).

Once you have stored your content (your secret key from openssl) in data bags, you can access them in recipes with `data_bag_item(bag_name, item, secret)` (again, see the [docs](https://docs.chef.io/dsl_recipe.html#data-bag-item) for sample code).

Hope this helps!

> **Comments:**
> **username_1**: The [`data_bag_item`](https://docs.chef.io/dsl_recipe.html#data-bag-item) in recipes DSL is the prefered way, it works with or without encryption, where your direct class access will fail on a clear text data bag (a pain to test then)  
> **username_2**: @username_1 True, but EncryptedDataBagItem will work because OP specified storing secrets, and that *has* to be encrypted.  
> **username_1**: It is just code smell to call a class instead of using its DSL helper. I assume you don't write recipes with `Chef::Resource::File.new('whatever') do |fres|` but instead you do `file 'whatever' do`... that's the same thing here.  
> **username_2**: @username_1 thanks for that, TIL. I've updated the answer, you learn something new every day :D  

---

### Answer by username_3 on 2017-05-11. Score: 2

I'm using the following ruby script to encrypt/decrypt chef data bags locally:
<https://gist.github.com/anonymous/4923ebeee53fe4d43a1cfb70a2abaadd>

to encrypt:

`ruby encrypt.rb PATH_TO_SECRET_FILE < UNECRYPTED_DATA_BAG.json > ENCRYPTED_DATA_BAG.json`

and to decrypt:

`ruby decrypt.rb PATH_TO_SECRET_FILE < ENCRYPTED_DATA_BAG.json > DECRYPTED_DATA_BAG.json`

> **Comments:**
> **username_1**: What the interest over knife built in commands ?  
> **username_0**: yes I do have a file encrypt.rb file. if I encrypt it above procedure don't I need a secret file to decrypt it.@username_3  
> **username_3**: @username_1 AFAIK knife commands are only relevant when you have a chef server and not for encrypting/decrypting JSON files locally (which is what I understood OP is interested in).  
> **username_3**: @username_0 you need to generate the secret file, in the 2nd tutorial you linked to this is explained in the first paragraph using `openssl`: ```Create a random encryption key: openssl rand -base64 512 | tr -d '\r\n' > secret_key ```  
> **username_1**: Since chef 12.18 (I think) you can use knife-zero to build on disk databags.  But I misunderstood the goal of your script indeed,  sorry for that  

---

### Answer by username_4 on 2017-05-10. Score: 1

A data bag is stored on the chef server itself. My chef days are behind me, but you should be able to enter the data bag content either at the create step or the edit one.
For the step 2, just execute the command that you copied:
knife data bag create passwords mysql --secret-file /tmp/my_data_bag_key

> **Comments:**
> **username_0**: Thanks, I would like to ask is there any way that I can create databag independent to chef server. I mean creating databag locally @Michael  
> **username_4**: Once again my chef skills are a little out of date so I can't pinpoint you to the exact location, but once you find it, you can follow this part of the tutorial to create the databags manually: https://docs.chef.io/data_bags.html#manually  
> **username_5**: @username_0 you can have local databags as test fixtures in kitchen.  There should be a way to make it work with chef-zero too, but I haven't played with that at all.  

---

