<p>You can set an environment variable <code>ANSIBLE_VAULT_PASSWORD_FILE</code> storing the path the the vault password file. This way you won't have the always use the <code>--vault-password-file</code> switch when running a playbook. </p>

<p>This is described in Ansible's Vault documentation, available <a href="http://docs.ansible.com/ansible/playbooks_vault.html" rel="nofollow noreferrer">here</a>.</p>

<p>So, add <code>export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt</code> to your <code>~/.bash_profile</code>, source from it and you're ready to go.</p>

<p>If you need different vault passwords for different groups of hosts, then you should do the following:</p>

<blockquote>
  <p>Inside of this subdirectory,
  create two files named vars and vault. Inside of the vars file, define
  all of the variables needed, including any sensitive ones. Next, copy
  all of the sensitive variables over to the vault file and prefix these
  variables with vault_. You should adjust the variables in the vars
  file to point to the matching vault_ variables and ensure that the
  vault file is vault encrypted.</p>
</blockquote>

<p>This is an example for best practices approach for managing sensitive information on per group basis. More information is available in Ansible's documentation <a href="http://docs.ansible.com/ansible/playbooks_best_practices.html#best-practices-for-variables-and-vaults" rel="nofollow noreferrer">here</a> (The above text is copied from there). </p>

CC BY-SA 3.0
2017-03-29T07:44:40.253Z
This won't allow a different password per hosts
Tensibai
CC BY-SA 3.0
2017-03-29T07:51:54.893Z
Are you referring to connection password? Because if you do, what does it have in common with Ansible Vault?
13dimitar
CC BY-SA 3.0
2017-03-29T07:54:15.067Z
I was referring to the vault password, willing to have different vault password for different groups makes sense (and is the root of the question as far as I understand it).
Tensibai
CC BY-SA 3.0
2017-03-29T08:01:18.403Z
I didn't understand it that way. I've edited my answer to include that scenario.
13dimitar
CC BY-SA 3.0
2017-03-29T08:05:04.027Z
seems better. Btw downvote is not mine
Tensibai
CC BY-SA 3.0
2017-03-30T07:52:48.423Z
`export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt`
030
CC BY-SA 3.0
2017-03-29T07:32:37.687Z
2017-03-30T08:13:57.597Z
2017-03-30T08:13:57.597Z
13dimitar
<p><a href="https://github.com/ansible/ansible/blob/devel/lib/ansible/constants.py" rel="noreferrer">Here</a> is the definition:</p>

<pre><code>DEFAULT_VAULT_PASSWORD_FILE = get_config(p, DEFAULTS, 'vault_password_file', \
'ANSIBLE_VAULT_PASSWORD_FILE', None, value_type='path')
</code></pre>

<hr>

<p>This means that you either put in ansible.cfg or playbook:</p>

<pre><code>vault_password_file: ~/.vault_pass.txt
</code></pre>

<p>Or in your shell defined this variable:</p>

<pre><code>export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt
</code></pre>

CC BY-SA 3.0
2017-03-30T07:30:33.770Z
@JiriKlouda it does not seem to work although it has been defined in `group_vars/all/vars`. `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt` had to be run.
030
CC BY-SA 3.0
2017-03-30T11:44:28.697Z
This is a config variable. It has to be in ansible.cfg or equivalent or in the playbook.
Jiri Klouda
CC BY-SA 3.0
2017-03-30T16:18:31.423Z
Also I have specifically checked the 2.2 version you run and it is there: https://github.com/ansible/ansible/blob/stable-2.2/lib/ansible/constants.py#L175
Jiri Klouda
CC BY-SA 3.0
2017-03-31T15:33:41.237Z
When I export the variable it works
030
CC BY-SA 3.0
2017-07-28T07:57:41.183Z
@JiriKlouda it's best to include the actual answer, not just the link, because links become invalid over time, and a direct answer is more useful too.
RichVel
CC BY-SA 3.0
2017-07-28T15:53:57.437Z
Sometimes that is the case, but when you point to a github repository of the project, that is being up to date as long as the project is being developed and relevant and if it goes out of date, it means the project is no longer relevant and the answer itself does not matter. In such case a link is better than a copy of answer which could itself become stale.
Jiri Klouda
CC BY-SA 4.0
2021-04-01T12:17:01.273Z
The docs say that DEFAULT_VAULT_PASSWORD_FILE can be used in the config. I'm running Ansible 2.10.1 and this doesn't work. But your clarification (from code) that it should actually be `vault_password_file` specified in the config fixed the situation for me.
fbicknel
CC BY-SA 3.0
2017-03-28T19:34:09.267Z
2017-03-30T13:48:38.560Z
2017-03-30T13:48:38.560Z
Jiri Klouda
<p>According the help of ansible-playbook one could use <code>--user=REMOTE_USER</code> to define the ssh user, but one could also define <code>ansible_ssh_user: REMOTE_USER</code> in either the host- or group_vars.</p>

<p><strong>Question</strong></p>

<p>What variable need to be defined in either the group- or host_vars directory to prevent that <code>--vault-password-file</code> has to be defined while running <code>ansible-playbook</code>?</p>

<p><strong>Attempts</strong></p>

<ul>
<li><p>When <code>ansible_vault_password_file: ~/.vault_pass.txt</code> is defined in the config the decryption fails:</p>

<pre><code>ERROR! Decryption failed on /path/to/vault
</code></pre></li>
<li><p>No associated vault variables was found in <a href="http://docs.ansible.com/ansible/intro_inventory.html" rel="noreferrer">this documentation</a></p></li>
</ul>

CC BY-SA 3.0
2017-03-30T08:15:45.590Z
Btw it's now documented (from version 1.7) here: http://docs.ansible.com/ansible/intro_configuration.html#vault-password-file
Tensibai
<ansible>
What is Ansible's config equivalent of `--vault-password-file`?
030
# What is Ansible's config equivalent of `--vault-password-file`?

(Asked by: username_0 on 2017-03-28)

According the help of ansible-playbook one could use --user=REMOTE_USER to define the ssh user, but one could also define ansible_ssh_user: REMOTE_USER in either the host- or group_vars.
Question
What variable need to be defined in either the group- or host_vars directory to prevent that --vault-password-file has to be defined while running ansible-playbook?
Attempts

When ansible_vault_password_file: ~/.vault_pass.txt is defined in the config the decryption fails:
ERROR! Decryption failed on /path/to/vault

No associated vault variables was found in this documentation

**Tags:** ansible

> **Comments:**
> **username_1**: Btw it's now documented (from version 1.7) here: http://docs.ansible.com/ansible/intro_configuration.html#vault-password-file  

---

## 2 answers

### Answer by username_3 on 2017-03-28. Score: 16 | Accepted answer

Here is the definition:
DEFAULT_VAULT_PASSWORD_FILE = get_config(p, DEFAULTS, 'vault_password_file', \
'ANSIBLE_VAULT_PASSWORD_FILE', None, value_type='path')


This means that you either put in ansible.cfg or playbook:
vault_password_file: ~/.vault_pass.txt

Or in your shell defined this variable:
export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt

> **Comments:**
> **username_0**: @JiriKlouda it does not seem to work although it has been defined in `group_vars/all/vars`. `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt` had to be run.  
> **username_3**: This is a config variable. It has to be in ansible.cfg or equivalent or in the playbook.  
> **username_3**: Also I have specifically checked the 2.2 version you run and it is there: https://github.com/ansible/ansible/blob/stable-2.2/lib/ansible/constants.py#L175  
> **username_0**: When I export the variable it works  
> **username_4**: @JiriKlouda it's best to include the actual answer, not just the link, because links become invalid over time, and a direct answer is more useful too.  
> **username_3**: Sometimes that is the case, but when you point to a github repository of the project, that is being up to date as long as the project is being developed and relevant and if it goes out of date, it means the project is no longer relevant and the answer itself does not matter. In such case a link is better than a copy of answer which could itself become stale.  
> **username_5**: The docs say that DEFAULT_VAULT_PASSWORD_FILE can be used in the config. I'm running Ansible 2.10.1 and this doesn't work. But your clarification (from code) that it should actually be `vault_password_file` specified in the config fixed the situation for me.  

---

### Answer by username_2 on 2017-03-29. Score: 3

You can set an environment variable `ANSIBLE_VAULT_PASSWORD_FILE` storing the path the the vault password file. This way you won't have the always use the `--vault-password-file` switch when running a playbook.

This is described in Ansible's Vault documentation, available [here](http://docs.ansible.com/ansible/playbooks_vault.html).

So, add `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt` to your `~/.bash_profile`, source from it and you're ready to go.

If you need different vault passwords for different groups of hosts, then you should do the following:

> Inside of this subdirectory,
> create two files named vars and vault. Inside of the vars file, define
> all of the variables needed, including any sensitive ones. Next, copy
> all of the sensitive variables over to the vault file and prefix these
> variables with vault\_. You should adjust the variables in the vars
> file to point to the matching vault\_ variables and ensure that the
> vault file is vault encrypted.

This is an example for best practices approach for managing sensitive information on per group basis. More information is available in Ansible's documentation [here](http://docs.ansible.com/ansible/playbooks_best_practices.html#best-practices-for-variables-and-vaults) (The above text is copied from there).

> **Comments:**
> **username_1**: This won't allow a different password per hosts  
> **username_2**: Are you referring to connection password? Because if you do, what does it have in common with Ansible Vault?  
> **username_1**: I was referring to the vault password, willing to have different vault password for different groups makes sense (and is the root of the question as far as I understand it).  
> **username_2**: I didn't understand it that way. I've edited my answer to include that scenario.  
> **username_1**: seems better. Btw downvote is not mine  
> **username_0**: `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt`  

---

