<p>This sounds like you are applying Ansible playbooks locally on peoples workstations.</p>
<p>The best way to protect this would be applying the playbooks using a remote system, like <a href="https://github.com/ansible/awx" rel="nofollow noreferrer">AWX</a> or a CI system such as <a href="https://github.com/features/actions" rel="nofollow noreferrer">GitHub Actions</a> or <a href="https://www.jetbrains.com/teamcity/" rel="nofollow noreferrer">TeamCity</a>. The CI system would have the ability to decrypt the vault and run the playbooks.</p>
<p>Mostly the CI system can expose the vault password to the job using an environment variable (that is hidden from end users and from the logs). You can then write a simple script which provides the password to the vault. Details here: <a href="https://docs.ansible.com/ansible/latest/user_guide/vault.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/user_guide/vault.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts</a></p>
<p>For example:</p>
<pre class="lang-py prettyprint-override"><code>#!/usr/bin/env python

import os
import sys

if &quot;ANSIBLE_VAULT_PASS&quot; in os.environ:
  sys.stdout.write('%s\n' % os.environ['ANSIBLE_VAULT_PASS'])
  sys.exit(0)

sys.exit(1)
</code></pre>

CC BY-SA 4.0
2021-07-21T09:57:50.120Z
2021-07-21T09:57:50.120Z
Matthew Hodgkins
<p>Historically we've been a one man devops team and stored all our passwords in Ansible vaults - including things like domain admin passwords and root account passwords.</p>
<p>However we're now growing and adding new team members and this creates a challenge. If we give all members of the devops team the vault and vault password they all suddenly have domain admin and root credentials - which we're hesitant to do. Some members of our team are more junior and we're trying to avoid handing out proverbial keys to the kingdom to everyone on the team.</p>
<p>However the Ansible scripts still need these credentials to function - to do things like join a windows active directory domain.</p>
<p>Is there a way with Ansible, Ansible tower or awx to grant a devops person the ability to use a credential without being able to decrypt and read it in clear text?</p>
<p>If not what other strategies do their teams use to address this situation?</p>

CC BY-SA 4.0
2021-07-12T17:52:29.650Z
IMHO, practically, it's not possible from the command line. To use a secret a playbook must be able to decrypt it. This means the secret is visible in some scope of a playbook. You'll have to prevent the administrator, who is running the playbook, from modifying the code, seeing the logs, etc. Moreover, this administrator shouldn't be able to debug such playbooks. There might be suitable [credentials](https://docs.ansible.com/ansible-tower/latest/html/userguide/credentials.html#getting-started-with-credentials) in AWX.
Vladimir Botka
<ansible><security><passwords>
Strategies for sharing Ansible vaults with root/administrator credentials?
Brad
# Strategies for sharing Ansible vaults with root/administrator credentials?

(Asked by: username_0 on 2021-07-12)

Historically we've been a one man devops team and stored all our passwords in Ansible vaults - including things like domain admin passwords and root account passwords.

However we're now growing and adding new team members and this creates a challenge. If we give all members of the devops team the vault and vault password they all suddenly have domain admin and root credentials - which we're hesitant to do. Some members of our team are more junior and we're trying to avoid handing out proverbial keys to the kingdom to everyone on the team.

However the Ansible scripts still need these credentials to function - to do things like join a windows active directory domain.

Is there a way with Ansible, Ansible tower or awx to grant a devops person the ability to use a credential without being able to decrypt and read it in clear text?

If not what other strategies do their teams use to address this situation?

**Tags:** ansible, security, passwords

> **Comments:**
> **username_1**: IMHO, practically, it's not possible from the command line. To use a secret a playbook must be able to decrypt it. This means the secret is visible in some scope of a playbook. You'll have to prevent the administrator, who is running the playbook, from modifying the code, seeing the logs, etc. Moreover, this administrator shouldn't be able to debug such playbooks. There might be suitable [credentials](https://docs.ansible.com/ansible-tower/latest/html/userguide/credentials.html#getting-started-with-credentials) in AWX.  

---

## 1 answers

### Answer by username_2 on 2021-07-21. Score: 1

This sounds like you are applying Ansible playbooks locally on peoples workstations.
The best way to protect this would be applying the playbooks using a remote system, like AWX or a CI system such as GitHub Actions or TeamCity. The CI system would have the ability to decrypt the vault and run the playbooks.
Mostly the CI system can expose the vault password to the job using an environment variable (that is hidden from end users and from the logs). You can then write a simple script which provides the password to the vault. Details here: https://docs.ansible.com/ansible/latest/user_guide/vault.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts
For example:
#!/usr/bin/env python

import os
import sys

if "ANSIBLE_VAULT_PASS" in os.environ:
  sys.stdout.write('%s\n' % os.environ['ANSIBLE_VAULT_PASS'])
  sys.exit(0)

sys.exit(1)


---

