Ansible Vault

What is Ansible Vault?

Having infrastructure as code can pose the threat of exposing your sensitive data to the world, leading to unwanted security issues. Ansible Vault is a feature that allows you to keep all your secrets safe. It can encrypt entire files, entire YAML playbooks or even a few variables. It provides a facility where you can not only encrypt sensitive data but also integrate them into your playbooks.

Vault is implemented with file-level granularity where the files are either entirely encrypted or entirely unencrypted. It uses the same password for encrypting as well as for decrypting files which makes using Ansible Vault very user-friendly.

Why use Ansible Vault?

As Ansible is being used for automation, there is a high possibility that playbooks contain certain credentials, SSL certificates, or other sensitive data. Saving such sensitive data as plain text is a bad idea. One wrong commit to GitHub or laptop theft can cause an organization a huge loss. This is where the Ansible vault comes into the picture. It is a great way of having infrastructure as code, without compromising on security.

Suppose, we have a playbook that provisions your EC2 instance on AWS. You need to provide your AWS access key id and AWS secret key in the playbook. You do not share these keys with others for obvious reasons. How do you keep them unexposed? There are two ways – Either encrypt these two variables and embed them into the playbook or encrypt the entire playbook.

This was just one of the scenarios where ansible vault can be used. We can either encrypt entire files or just encrypt few variables which might hold sensitive data and then Ansible automatically decrypts them during runtime. Now we can safely commit these values to GitHub.

Creating Encrypted File

To create an encrypted file, use the ansible-vault create command and pass the filename.

$ ansible-vault create filename.yaml

You’ll be prompted to create a password and then confirm it by re-typing it.  

Once your password is confirmed, a new file will be created and will open an editing window. By default, the editor for Ansible Vault is vi. You can add data, save and exit. 

And your file is encrypted.

Relevant Blogs:

Ansible Playbook 

Blockinfile module in ansible 

Statefulset in kubernetes 

Basics of Jenkins Ansible