{"id":9440,"date":"2024-04-07T05:11:20","date_gmt":"2024-04-07T05:11:20","guid":{"rendered":"https:\/\/cheapwindowsvps.com\/blog\/mastering-encryption-and-decryption-with-ansible-vault\/"},"modified":"2025-01-20T10:33:21","modified_gmt":"2025-01-20T10:33:21","slug":"mastering-encryption-and-decryption-with-ansible-vault","status":"publish","type":"post","link":"https:\/\/cheapwindowsvps.com\/blog\/mastering-encryption-and-decryption-with-ansible-vault\/","title":{"rendered":"Mastering Encryption and Decryption with Ansible Vault"},"content":{"rendered":"<p><div>Ansible Vault allows you to encrypt sensitive data such as passwords, keys, and other secrets rather than storing them as plaintext in your playbooks or roles. In this tutorial, I will explain how to use Ansible Vault to encrypt and decrypt data during playbook runtime.<\/div>\n<\/p>\n<p><h2>Prerequisites<\/h2>\n<\/p>\n<p><p>To proceed with this tutorial, you will need the following:<\/p>\n<\/p>\n<ul>\n<li>An Ansible management node with Ansible installed and configured<\/li>\n<li>An Ansible target node<\/li>\n<li>SSH key-based authentication between the management node and the target node<\/li>\n<\/ul>\n<p><p>Check out our <a href=\"https:\/\/4sysops.com\/archives\/ansible-beginner-tutorial\/\" rel=\"nofollow noopener\" target=\"_blank\">introductory articles in this Ansible beginner&#8217;s tutorial<\/a>, where we explain how to configure the necessary prerequisites.<\/p>\n<h2>Encrypting data with Ansible Vault<\/h2>\n<p>Ansible Vault uses symmetric encryption to protect data. To create a new encrypted file, use the <em>ansible-vault create<\/em> command followed by the name of your new file:<\/p>\n<pre>ansible-vault create secrets.yml<\/p><p><\/pre>\n<\/p>\n<p><p>You will be prompted to enter a password. This password will be used to encrypt the file.<\/p>\n<\/p>\n<p><pre>New Vault password: <\/p><p>Confirm New Vault password:<\/p><p><\/pre>\n<\/p>\n<p><p>After entering the password, you will be taken to an editor where you can enter your sensitive data:<\/p>\n<\/p>\n<p><pre>db_password: mysecretpassword<\/p><p><\/pre>\n<\/p>\n<p><p>Save and close the file. Your data is now encrypted. You can view the encrypted data using this command:<\/p>\n<\/p>\n<p><pre>cat secrets.yml<\/pre>\n<\/p>\n<p><a href=\"https:\/\/4sysops.com\/wp-content\/uploads\/2024\/04\/Displaying-encrypted-data.png\" rel=\"nofollow noopener\" target=\"_blank\">Displaying encrypted data<\/a><\/p>\n<p><h2>Viewing encrypted data<\/h2>\n<\/p>\n<p><p>To view the contents of an encrypted file named <em>secrets.yml<\/em> using Ansible Vault, you can use the <em>ansible-vault view<\/em> command.<\/p>\n<\/p>\n<p><pre>ansible-vault view secrets.yml<\/p><p><\/pre>\n<\/p>\n<p><p>After running this command, Ansible Vault will prompt you to enter the vault password. Once you provide the correct password, it will decrypt and display the contents of the <em>secrets.yml<\/em> file in your terminal.<\/p>\n<\/p>\n<p><a href=\"https:\/\/4sysops.com\/wp-content\/uploads\/2024\/04\/Displaying-decrypted-data.png\" rel=\"nofollow noopener\" target=\"_blank\">Displaying decrypted data<\/a><\/p>\n<p><h2>Editing encrypted files<\/h2>\n<\/p>\n<p><p>If you want to edit an encrypted file, you can use the <em>ansible-vault edit<\/em> command:<\/p>\n<\/p>\n<p><pre>ansible-vault edit secrets.yml<\/p><p><\/pre>\n<\/p>\n<p><p>You will be prompted to enter your password when creating the file.<\/p>\n<\/p>\n<p><p>Vault password:<\/p>\n<\/p>\n<p><p>After entering the password, you can view and edit your sensitive data.<\/p>\n<\/p>\n<p><p>db_password: mysecretpassword<\/p>\n<\/p>\n<p><p>When you save the file, Ansible Vault will encrypt it again.<\/p>\n<\/p>\n<p><h2>Decrypting encrypted files<\/h2>\n<\/p>\n<p><p>If you want to store the file in plaintext, you can use the <em>ansible-vault decrypt<\/em> command:<\/p>\n<\/p>\n<p><pre>ansible-vault decrypt secrets.yml<\/p><p><\/pre>\n<\/p>\n<p><p>You will be asked to enter your vault password to decrypt the file.<\/p>\n<\/p>\n<p><pre>Vault password: <\/p><p>Decryption successful<\/p><p><\/pre>\n<p>The cat command allows you to view the decrypted file.<\/p>\n<pre>cat secrets.yml<\/p><p><\/pre>\n<p>Output.<\/p>\n<\/p>\n<p><h2>Changing the vault password<\/h2>\n<\/p>\n<p><p>Rotating your vault passwords periodically is a wise move to boost security. You can conveniently re-encrypt existing files with a new password using Ansible Vault.<\/p>\n<\/p>\n<p><p>If you need to rekey an encrypted file named <em>secrets.yml<\/em>, you can use the <em>ansible-vault rekey<\/em> command:<\/p>\n<\/p>\n<p><pre>ansible-vault rekey secrets.yml<\/pre>\n<\/p>\n<p><p>After you provide the correct password, Ansible Vault will ask for the new vault password. After confirming the new password, Ansible Vault will re-encrypt the file with the new password.<\/p>\n<\/p>\n<p><a href=\"https:\/\/4sysops.com\/wp-content\/uploads\/2024\/04\/Changing-the-vault-password.png\" rel=\"nofollow noopener\" target=\"_blank\">Changing the vault password<\/a><\/p>\n<p><h2>Running Playbooks with vaulted files<\/h2>\n<\/p>\n<p><p>There are two methods to run an Ansible playbook with a vault password:<em> &#8211;ask-vault-pass<\/em> and <em>vault_password_file<\/em><\/p>\n<\/p>\n<p><h3>Using &#8211;ask-vault-pass<\/h3>\n<\/p>\n<p><p>You can provide the vault password interactively during playbook runtime by using the <em>&#8211;ask-vault-pass<\/em> option.<\/p>\n<\/p>\n<p><pre>ansible-playbook playbook.yml --ask-vault-pass<\/pre>\n<\/p>\n<p><p>Ansible will prompt you to enter the vault password before executing the playbook.<\/p>\n<\/p>\n<p><h3>Using a vault password file<\/h3>\n<\/p>\n<p><p>You can also store the vault password in a plaintext file and reference it in your Ansible configuration file using the <em>vault_password_file<\/em> parameter. This method eliminates the need to enter the vault password interactively.<\/p>\n<\/p>\n<p><pre>nano \/etc\/ansible\/ansible.cfg<\/p><p><\/pre>\n<\/p>\n<p><p>Add the following line to define the path of your vault password file:<\/p>\n<pre>[defaults]<\/p><p>vault_password_file = \/etc\/ansible\/vault_password.txt<\/p><p><\/pre>\n<p>Next, create a file to store the vault password.<\/p>\n<pre>nano \/etc\/ansible\/vault_password.txt<\/p><p><\/pre>\n<\/p>\n<p><p>Add your vault password:<\/p>\n<\/p>\n<p><pre>YourVaultPassword<\/pre>\n<\/p>\n<p><p>Ensure that the vault password file contains only the password and restrict access permissions to prevent unauthorized usage. You can now run your playbook as usual without providing a vault password.<\/p>\n<\/p>\n<p><h2>Using Ansible Vault in a playbook<\/h2>\n<\/p>\n<p><p>An Ansible playbook is used in this example to create a MySQL database. Ansible Vault securely stores the root and user password.<\/p>\n<\/p>\n<p><p>To begin with, a vars directory needs to be created.<\/p>\n<\/p>\n<p><pre>mkdir vars<\/p><p><\/pre>\n<\/p>\n<p><p>Subsequently, a new vault file should be created to store the MySQL root and user password:<\/p>\n<\/p>\n<p><pre>ansible-vault create vars\/mysql_vault.yml<\/pre>\n<\/p>\n<p><p>When prompted, enter the vault password and then add the following lines to define your passwords:<\/p>\n<\/p>\n<p><pre>mysql_root_password: SecureRootPassword<\/p><p>mysql_user_password: SecureUserPassword<\/p><p><\/pre>\n<\/p>\n<p><p>Next, create an Ansible playbook that uses this password to create a new MySQL database and user on a remote node.<\/p>\n<\/p>\n<p><pre><\/p><p>nano mysql_setup.yml<\/p><p><\/pre>\n<p>Here is the content that needs to be added.<\/p>\n<pre><\/p><p>---<\/p><p>- name: Generate MySQL Database and User<\/p><p>  hosts: node1<\/p><p>  vars_files:<\/p><p>    - vars\/mysql_vault.yml<\/p><p>  tasks:<\/p><p>    - name: Launch MySQL service<\/p><p>      service:<\/p><p>        name: mysql<\/p><p>        state: started<\/p><p>  <\/p><p>    - name: Establish database<\/p><p>      mysql_db:<\/p><p>        name: wp_db<\/p><p>        state: present<\/p><p>        login_user: root<\/p><p>        login_password: \"{{ mysql_root_password }}\"<\/p><p>  <\/p><p>    - name: Set up database user<\/p><p>      mysql_user:<\/p><p>        name: wp_user<\/p><p>        password: \"{{ mysql_user_password }}\"<\/p><p>        priv: \"wp_db.*:ALL\"<\/p><p>        state: present<\/p><p>        login_user: root<\/p><p>        login_password: \"{{ mysql_root_password }}\"<\/p><p><\/pre>\n<p>This is what the above code signifies:<\/p>\n<p> <a href=\"#\" rel=\"nofollow noopener\" target=\"_blank\">Explanation here<\/a><\/p>\n<ul>\n<li><strong>vars_files<\/strong>: This directive includes the file <em>mysql_vault.yml<\/em>, where the encrypted variables are stored.<\/li>\n<li><strong>mysql_root_password<\/strong>: This variable stores the encrypted MySQL root password.<\/li>\n<li><strong>mysql_user_password<\/strong>: This variable stores the plaintext password for the new MySQL user.<\/li>\n<li><strong>mysql_db<\/strong>: This task creates a MySQL database named <em>wp_db<\/em>.<\/li>\n<li><strong>mysql_user<\/strong>: This task creates a MySQL user named <em>wp_user<\/em> with a specified password and grants privileges on the <em>my_database<\/em>.<\/li>\n<\/ul>\n<p><p>Finally, run the playbook with the following command:<\/p>\n<\/p>\n<p><pre>ansible-playbook mysql_setup.yml --ask-vault-pass<\/pre>\n<\/p>\n<p><p>Before the playbook is executed, you have to enter the vault password. The playbook will then read the MySQL root password from the vault file and use it to create the database and user.<\/p>\n<\/p>\n<p><h2>Subscribe to 4sysops newsletter!<\/h2>\n<\/p>\n<p><div><a href=\"https:\/\/4sysops.com\/wp-content\/uploads\/2024\/04\/Creating-database-and-user-using-Ansible-vault.png\" rel=\"nofollow noopener\" target=\"_blank\">Creating database and user using Ansible vault<\/a><\/div>\n<\/p>\n<p><p>Creating database and user using Ansible vault<\/p>\n<\/p>\n<p><h2>Conclusion<\/h2>\n<\/p>\n<p><p>In this tutorial, you learned how to encrypt and decrypt sensitive data using Ansible Vault. We have also used Ansible Vault in a playbook to create a MySQL database with root and user passwords. Encrypting sensitive information is a must if security matters in your environment.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ansible Vault allows you to encrypt sensitive data such as passwords, keys, and other secrets rather than storing them as plaintext in your playbooks or roles. In this tutorial, I will explain how to use Ansible Vault to encrypt and decrypt data during playbook runtime. Prerequisites To proceed with this tutorial, you will need the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":9441,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[118,92,111,95,115,114],"tags":[],"class_list":["post-9440","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ansible","category-articles","category-deployment","category-devops","category-encryption","category-security"],"_links":{"self":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/comments?post=9440"}],"version-history":[{"count":2,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9440\/revisions"}],"predecessor-version":[{"id":10397,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9440\/revisions\/10397"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media\/9441"}],"wp:attachment":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media?parent=9440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/categories?post=9440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/tags?post=9440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}