Protecting sensitive data with Ansible vault

Note

Making Open Source More Inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. We ask that you open an issue or pull request if you come upon a term that we have missed. For more details, see our CTO Chris Wright’s message.

Welcome to the Ansible vault documentation. Ansible vault provides a way to encrypt and manage sensitive data such as passwords. This guide introduces you to Ansible vault and covers the following topics:

Managing vault passwords.
Encrypting content and files with Ansible vault.
Using encrypted variables and files.

Ansible Vault
Managing vault passwords
Encrypting content with Ansible Vault
- Encrypting individual variables with Ansible Vault
- Encrypting files with Ansible Vault
Using encrypted variables and files
Configuring defaults for using encrypted content
- Setting a default vault ID
- Setting a default password source
When are encrypted files made visible?
Format of files encrypted with Ansible Vault
- Ansible Vault payload format 1.1 - 1.2

© 2012–2018 Michael DeHaan
© 2018–2025 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/projects/ansible/latest/vault_guide/index.html