Ansible Vault: How to Use Ansible Vault to Keep Your Secrets Safe

Managing configuration files may be difficult, especially when dealing with sensitive data. The sensitive data might be stored in plain text files, which is not a secure approach. Ansible Vault is very useful here. Ansible Vault is a solution for securely storing sensitive data including passwords, SSH keys, and API credentials. This is done by encrypting the data and putting it in a file only authorized users may decrypt.

In this blog, we’ll look more closely into Ansible Vault and demonstrate how to utilize it with an example.

What is Ansible Vault?

Ansible Vault is an Ansible tool that enables users to encrypt sensitive data like as passwords, API credentials, and other secrets. This adds an extra degree of protection for managing sensitive data in configuration files, playbooks, and inventory files. The encrypted data is saved in a file that can only be decrypted using a specified password or key. This helps to prevent unauthorized access and keeps critical information safe.

Getting Started with Ansible Vault:

1) Creating a Vault File:

The first step in using Ansible Vault is to create a vault file. You can do this by running ansible-vault create followed by the name of the file you wish to create. For example, if you wish to create a file called ninotronix_secrets.yml, run the following command:

$ ansible-vault create ninotronix_secrets.yml

Ansible Vault will then request you to enter a password for the vault file. This password will be used to encrypt and decrypt the file, so make it strong and secure. The vault file will be created and opened in your default text editor when you enter the password. You may now add your confidential information to the vault file.

2) Editing a Vault File:

To modify an existing vault file, use the ansible-vault edit command followed by the file name to be edited. For example, if you wish to change the contents of the ninotronix_secrets.yml file.

Use the following command.

$ ansible-vault edit ninotronix_secrets.yml

It will prompt you to enter the vault file’s password. The vault file will be opened in your usual text editor when you enter the password. You may now make any changes to the file you desire, save it, and exit your text editor.

3) Viewing a Vault File:

To see the contents of a vault file, use the ansible-vault view command followed by the name of the file. For example, to look at the ninotronix_secrets.yml file,

Execute the following command:

$ ansible-vault view ninotronix_secrets.yml

It will prompt you to enter the vault file password again. When you input the password, the contents of the vault file will be shown on your terminal.

4) Encrypting and Decrypting a Vault File:

To encrypt a plain text file and convert it to a vault file, use the ansible-vault encrypt command followed by the file name to encrypt. For example, to encrypt a file called plain.yml,

Carry out the following command:

$ ansible-vault encrypt plain.yml

It will ask you to provide a password for the vault file. After you enter the password, the plain.yml file will be encrypted.

To decrypt a vault file and return it to plain text, use the ansible-vault decrypt command followed by the name of the file to decrypt. For example, if you wish to decrypt a file called plain.yml, run the command:

$ ansible-vault decrypt plain.yml

The encrypted plain.yml file will be decrypted and stored as plain.yml when you enter the password.

5) Rekeying a Vault File:

Rekeying a vault file is the process of altering the password or encryption key for an already encrypted file. This is useful if the password has to be updated for security reasons or if the person who encrypted the file is no longer available.

You may run the following command to rekey a vault file:

$ ansible-vault rekey ninotronix_secrets.yml

This command will request your existing password before prompting you to enter a new one. The vault file will be rekeyed with the new password once you have typed it twice and it has been confirmed.

It is important to note that rekeying a vault file only changes the password or encryption key, not the file’s contents.

You can get started with Ansible Vault and use it to safeguard sensitive data by following the procedures shown in this article. So go ahead and give it a shot and use Ansible Vault to take your automation to the next level!