Secure Secrets with Ansible Vault: Use Encrypted Strings

Some variables do not contain sensitive information. Those variables could also be instrumental when troubleshooting. And in certain situations, it might not make sense to encrypt the entire file, making discovery more difficult.

Perhaps we only want to encrypt the sensitive variables and not the whole file. Ansible Vault can do that, too.

You will create an encrypted string for the ansible_password variable and decrypt the group variable files.

1. Generate an encrypted string variable for ansible_password. When prompted, enter the vault password.

   • Replace <Password> with the ansible user password.

   • Copy the ansible_password encrypted string value to the clipboard.

2. Open linux.yml and windows.yml. Replace the ansible_password variable with the encrypted string.

3. Verify that the variables are loading.

Decryption
When using encrypted strings, the ansible-inventory does not decrypt the string.

4. Use the debug module to output the decrypted variable. When prompted, enter the vault password.

Shell History
The method of using the echo command to populate the encrypted string leaves the shell history password. Please do not use it outside of testing.

You can use the following command in its stead:

Caution
Do not press Enter after supplying the string to encrypt. That will add a newline to the encrypted value.

5. Review the hosts file and the host_vars and ensure that the files’ names and the IP addresses in the files match using the cat command.

6. Update the passwords in the group_vars files.

7. Review the group_vars/windows_encrypted.yml and group_vars/linux_encrypted.yml files.

We have provided these demo encrypted files for your review. The group_vars/{windows|linux}.yml will look something like the group_vars/{windows/linux}_encrypted.yml files, respectively.

8. Run the commands.

Click on the Run button, wait for the environment to set up, and execute the commands summarized below in the widget’s terminal.

In this lesson, we introduced how you can encrypt only the secret variables instead of the entire file. We looked at the following option with the ansible-vault command:

• encrypt_string
• debug