<p>Having been working with ansible vault quite a bit recently (specifically regarding what the encrypt and how to encrypt those things without making the code unreadable) I've found very little incentive to change my habits in 2.3.</p>

<p>If I'm going to have a series of encrypted variables, or files, keep them separate (I prefix them all with <code>vault_</code>) and just leave it at that.</p>

<p>A few times I have used the !vault feature but am left distinctly unamazed as it seems easier to just be very explicit about what is and is not coming from a secrets file. That way no one editing my plays makes assumptions about what is and isn't sensitive data.</p>

CC BY-SA 4.0
2017-04-24T17:26:40.027Z
2019-12-23T07:24:43.370Z
2019-12-23T07:24:43.370Z
hvindin
<p>I have decided to remove the <code>ansible/group_vars/testing</code> directory and replace it with a file, i.e. <code>ansible/group_vars/testing</code> that contains the encrypted vars:</p>

<pre><code>mysecret: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66386439653236336462626566653063336164663966303231363934653561363964363833313662
          6431626536303530376336343832656537303632313433360a626438346336353331386135323734
          62656361653630373231613662633962316233633936396165386439616533353965373339616234
          3430613539666330390a313736323265656432366236633330313963326365653937323833366536
          34623731376664623134383463316265643436343438623266623965636363326136
</code></pre>

<p>Instead of running <code>ansible-vault edit ansible/group_vars/testing/vault</code> one could pipe the values that need to be encrypted to ansible-vault, i.e. <code>printf mysecret | ansible-vault encrypt</code>. The latter will encrypt <code>mysecret</code> and the output could be added to the <code>ansible/group_vars/testing</code> file. When <code>ansible-playbook</code> will be run the encrypted variables will be decrypted if the ansible vault file is specified of course.</p>

<p>If the encrypted value needs to be debugged then the following code could be used:</p>

<pre><code>- debug: msg="Decrypted value: {{ encrypted_var }}"
</code></pre>

CC BY-SA 3.0
2017-04-23T17:56:21.803Z
2017-04-24T08:43:09.153Z
2017-04-24T08:43:09.153Z
030
<p><a href="http://docs.ansible.com/ansible/playbooks_vault.html#single-encrypted-variable" rel="nofollow noreferrer">This</a> document indicates that since Ansible 2.3 it should be possible to encrypt certain vars using a <code>!vault |</code> prefix instead of putting a variable and keys in a vault file and encrypt it completely.</p>

<blockquote>
<pre><code>notsecret: myvalue
mysecret: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66386439653236336462626566653063336164663966303231363934653561363964363833313662
          6431626536303530376336343832656537303632313433360a626438346336353331386135323734
          62656361653630373231613662633962316233633936396165386439616533353965373339616234
          3430613539666330390a313736323265656432366236633330313963326365653937323833366536
          34623731376664623134383463316265643436343438623266623965636363326136
other_plain_text: othervalue
</code></pre>
</blockquote>

<p>At the moment the structure is as follows:</p>

<pre><code>ansible/group_vars/testing/vars
ansible/group_vars/testing/vault
</code></pre>

<p>When an encrypted variable is moved from the vault to the vars directory and <code>ansible-vault decrypt ansible/group_vars/testing/vars</code> is run it returns:</p>

<pre><code>ERROR! input is not vault encrypted data for ansible/group_vars/testing/vars
</code></pre>

<blockquote>
  <p>This vaulted variable be decrypted with the supplied vault secret and
  used as a normal variable. The ansible-vault command line supports
  stdin and stdout for encrypting data on the fly, which can be used
  from your favorite editor to create these vaulted variables; you just
  have to be sure to add the !vault tag so both Ansible and YAML are
  aware of the need to decrypt. The | is also required, as vault
  encryption results in a multi-line string.</p>
</blockquote>

<p><strong>Questions</strong></p>

<ol>
<li>Should variables that need to be encrypted, be encrypted one by one
using the command line? </li>
<li>What are best practices to restructure the
old Ansible structure? E.g. remove the vault files and put all
encrypted vars in the vars file?</li>
</ol>

<ansible-vault>
What are best practices of structuring encrypting variables since Ansible 2.3.0?
030
# What are best practices of structuring encrypting variables since Ansible 2.3.0?

(Asked by: username_0 on 2017-04-23)

This document indicates that since Ansible 2.3 it should be possible to encrypt certain vars using a !vault | prefix instead of putting a variable and keys in a vault file and encrypt it completely.

notsecret: myvalue
mysecret: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66386439653236336462626566653063336164663966303231363934653561363964363833313662
          6431626536303530376336343832656537303632313433360a626438346336353331386135323734
          62656361653630373231613662633962316233633936396165386439616533353965373339616234
          3430613539666330390a313736323265656432366236633330313963326365653937323833366536
          34623731376664623134383463316265643436343438623266623965636363326136
other_plain_text: othervalue


At the moment the structure is as follows:
ansible/group_vars/testing/vars
ansible/group_vars/testing/vault

When an encrypted variable is moved from the vault to the vars directory and ansible-vault decrypt ansible/group_vars/testing/vars is run it returns:
ERROR! input is not vault encrypted data for ansible/group_vars/testing/vars


This vaulted variable be decrypted with the supplied vault secret and
  used as a normal variable. The ansible-vault command line supports
  stdin and stdout for encrypting data on the fly, which can be used
  from your favorite editor to create these vaulted variables; you just
  have to be sure to add the !vault tag so both Ansible and YAML are
  aware of the need to decrypt. The | is also required, as vault
  encryption results in a multi-line string.

Questions

Should variables that need to be encrypted, be encrypted one by one
using the command line? 
What are best practices to restructure the
old Ansible structure? E.g. remove the vault files and put all
encrypted vars in the vars file?

**Tags:** ansible-vault


---

## 2 answers

### Answer by username_1 on 2017-04-24. Score: 2 | Accepted answer

Having been working with ansible vault quite a bit recently (specifically regarding what the encrypt and how to encrypt those things without making the code unreadable) I've found very little incentive to change my habits in 2.3.

If I'm going to have a series of encrypted variables, or files, keep them separate (I prefix them all with `vault_`) and just leave it at that.

A few times I have used the !vault feature but am left distinctly unamazed as it seems easier to just be very explicit about what is and is not coming from a secrets file. That way no one editing my plays makes assumptions about what is and isn't sensitive data.


---

### Answer by username_0 on 2017-04-23. Score: 1

I have decided to remove the ansible/group_vars/testing directory and replace it with a file, i.e. ansible/group_vars/testing that contains the encrypted vars:
mysecret: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66386439653236336462626566653063336164663966303231363934653561363964363833313662
          6431626536303530376336343832656537303632313433360a626438346336353331386135323734
          62656361653630373231613662633962316233633936396165386439616533353965373339616234
          3430613539666330390a313736323265656432366236633330313963326365653937323833366536
          34623731376664623134383463316265643436343438623266623965636363326136

Instead of running ansible-vault edit ansible/group_vars/testing/vault one could pipe the values that need to be encrypted to ansible-vault, i.e. printf mysecret | ansible-vault encrypt. The latter will encrypt mysecret and the output could be added to the ansible/group_vars/testing file. When ansible-playbook will be run the encrypted variables will be decrypted if the ansible vault file is specified of course.
If the encrypted value needs to be debugged then the following code could be used:
- debug: msg="Decrypted value: {{ encrypted_var }}"


---

