Answers: <p>You can set an environment variable <code>ANSIBLE_VAULT_PASSWORD_FILE</code> storing the path the the vault password file. This way you won't have the always use the <code>--vault-password-file</code> switch when running a playbook. </p>
  
  <p>This is described in Ansible's Vault documentation, available <a href="http://docs.ansible.com/ansible/playbooks_vault.html" rel="nofollow noreferrer">here</a>.</p>
  
  <p>So, add <code>export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt</code> to your <code>~/.bash_profile</code>, source from it and you're ready to go.</p>
  
  <p>If you need different vault passwords for different groups of hosts, then you should do the following:</p>
  
  <blockquote>
    <p>Inside of this subdirectory,
    create two files named vars and vault. Inside of the vars file, define
    all of the variables needed, including any sensitive ones. Next, copy
    all of the sensitive variables over to the vault file and prefix these
    variables with vault_. You should adjust the variables in the vars
    file to point to the matching vault_ variables and ensure that the
    vault file is vault encrypted.</p>
  </blockquote>
  
  <p>This is an example for best practices approach for managing sensitive information on per group basis. More information is available in Ansible's documentation <a href="http://docs.ansible.com/ansible/playbooks_best_practices.html#best-practices-for-variables-and-vaults" rel="nofollow noreferrer">here</a> (The above text is copied from there). </p>
  
Answers: CC BY-SA 3.0
Answers: 2017-03-29T07:44:40.253Z
Answers: This won't allow a different password per hosts
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-03-29T07:51:54.893Z
Answers: Are you referring to connection password? Because if you do, what does it have in common with Ansible Vault?
Answers: 13dimitar
Answers: CC BY-SA 3.0
Answers: 2017-03-29T07:54:15.067Z
Answers: I was referring to the vault password, willing to have different vault password for different groups makes sense (and is the root of the question as far as I understand it).
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-03-29T08:01:18.403Z
Answers: I didn't understand it that way. I've edited my answer to include that scenario.
Answers: 13dimitar
Answers: CC BY-SA 3.0
Answers: 2017-03-29T08:05:04.027Z
Answers: seems better. Btw downvote is not mine
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-03-30T07:52:48.423Z
Answers: `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt`
Answers: 030
Answers: CC BY-SA 3.0
Answers: 2017-03-29T07:32:37.687Z
Answers: 2017-03-30T08:13:57.597Z
Answers: 2017-03-30T08:13:57.597Z
Answers: 13dimitar
Answers: <p><a href="https://github.com/ansible/ansible/blob/devel/lib/ansible/constants.py" rel="noreferrer">Here</a> is the definition:</p>
  
  <pre><code>DEFAULT_VAULT_PASSWORD_FILE = get_config(p, DEFAULTS, 'vault_password_file', \
  'ANSIBLE_VAULT_PASSWORD_FILE', None, value_type='path')
  </code></pre>
  
  <hr>
  
  <p>This means that you either put in ansible.cfg or playbook:</p>
  
  <pre><code>vault_password_file: ~/.vault_pass.txt
  </code></pre>
  
  <p>Or in your shell defined this variable:</p>
  
  <pre><code>export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-03-30T07:30:33.770Z
Answers: @JiriKlouda it does not seem to work although it has been defined in `group_vars/all/vars`. `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt` had to be run.
Answers: 030
Answers: CC BY-SA 3.0
Answers: 2017-03-30T11:44:28.697Z
Answers: This is a config variable. It has to be in ansible.cfg or equivalent or in the playbook.
Answers: Jiri Klouda
Answers: CC BY-SA 3.0
Answers: 2017-03-30T16:18:31.423Z
Answers: Also I have specifically checked the 2.2 version you run and it is there: https://github.com/ansible/ansible/blob/stable-2.2/lib/ansible/constants.py#L175
Answers: Jiri Klouda
Answers: CC BY-SA 3.0
Answers: 2017-03-31T15:33:41.237Z
Answers: When I export the variable it works
Answers: 030
Answers: CC BY-SA 3.0
Answers: 2017-07-28T07:57:41.183Z
Answers: @JiriKlouda it's best to include the actual answer, not just the link, because links become invalid over time, and a direct answer is more useful too.
Answers: RichVel
Answers: CC BY-SA 3.0
Answers: 2017-07-28T15:53:57.437Z
Answers: Sometimes that is the case, but when you point to a github repository of the project, that is being up to date as long as the project is being developed and relevant and if it goes out of date, it means the project is no longer relevant and the answer itself does not matter. In such case a link is better than a copy of answer which could itself become stale.
Answers: Jiri Klouda
Answers: CC BY-SA 4.0
Answers: 2021-04-01T12:17:01.273Z
Answers: The docs say that DEFAULT_VAULT_PASSWORD_FILE can be used in the config. I'm running Ansible 2.10.1 and this doesn't work. But your clarification (from code) that it should actually be `vault_password_file` specified in the config fixed the situation for me.
Answers: fbicknel
Answers: CC BY-SA 3.0
Answers: 2017-03-28T19:34:09.267Z
Answers: 2017-03-30T13:48:38.560Z
Answers: 2017-03-30T13:48:38.560Z
Answers: Jiri Klouda
Body: <p>According the help of ansible-playbook one could use <code>--user=REMOTE_USER</code> to define the ssh user, but one could also define <code>ansible_ssh_user: REMOTE_USER</code> in either the host- or group_vars.</p>
  
  <p><strong>Question</strong></p>
  
  <p>What variable need to be defined in either the group- or host_vars directory to prevent that <code>--vault-password-file</code> has to be defined while running <code>ansible-playbook</code>?</p>
  
  <p><strong>Attempts</strong></p>
  
  <ul>
  <li><p>When <code>ansible_vault_password_file: ~/.vault_pass.txt</code> is defined in the config the decryption fails:</p>
  
  <pre><code>ERROR! Decryption failed on /path/to/vault
  </code></pre></li>
  <li><p>No associated vault variables was found in <a href="http://docs.ansible.com/ansible/intro_inventory.html" rel="noreferrer">this documentation</a></p></li>
  </ul>
  
Comments: CC BY-SA 3.0
Comments: 2017-03-30T08:15:45.590Z
Comments: Btw it's now documented (from version 1.7) here: http://docs.ansible.com/ansible/intro_configuration.html#vault-password-file
Comments: Tensibai
Tags: <ansible>
Title: What is Ansible's config equivalent of `--vault-password-file`?
UserDisplayName: 030
ThreadText: # What is Ansible's config equivalent of `--vault-password-file`?
  
  (Asked by: username_0 on 2017-03-28)
  
  According the help of ansible-playbook one could use `--user=REMOTE_USER` to define the ssh user, but one could also define `ansible_ssh_user: REMOTE_USER` in either the host- or group\_vars.
  
  **Question**
  
  What variable need to be defined in either the group- or host\_vars directory to prevent that `--vault-password-file` has to be defined while running `ansible-playbook`?
  
  **Attempts**
  
  * When `ansible_vault_password_file: ~/.vault_pass.txt` is defined in the config the decryption fails:
  
    ```
    ERROR! Decryption failed on /path/to/vault
  
    ```
  * No associated vault variables was found in [this documentation](http://docs.ansible.com/ansible/intro_inventory.html)
  
  **Tags:** ansible
  
  > **Comments:**
  > **username_1**: Btw it's now documented (from version 1.7) here: http://docs.ansible.com/ansible/intro_configuration.html#vault-password-file  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_3 on 2017-03-28. Score: 16 | Accepted answer
  
  [Here](https://github.com/ansible/ansible/blob/devel/lib/ansible/constants.py) is the definition:
  
  ```
  DEFAULT_VAULT_PASSWORD_FILE = get_config(p, DEFAULTS, 'vault_password_file', \
  'ANSIBLE_VAULT_PASSWORD_FILE', None, value_type='path')
  
  ```
  
  ---
  
  This means that you either put in ansible.cfg or playbook:
  
  ```
  vault_password_file: ~/.vault_pass.txt
  
  ```
  
  Or in your shell defined this variable:
  
  ```
  export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt
  
  ```
  
  > **Comments:**
  > **username_0**: @username_3 it does not seem to work although it has been defined in `group_vars/all/vars`. `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt` had to be run.  
  > **username_3**: This is a config variable. It has to be in ansible.cfg or equivalent or in the playbook.  
  > **username_3**: Also I have specifically checked the 2.2 version you run and it is there: https://github.com/ansible/ansible/blob/stable-2.2/lib/ansible/constants.py#L175  
  > **username_0**: When I export the variable it works  
  > **username_4**: @username_3 it's best to include the actual answer, not just the link, because links become invalid over time, and a direct answer is more useful too.  
  > **username_3**: Sometimes that is the case, but when you point to a github repository of the project, that is being up to date as long as the project is being developed and relevant and if it goes out of date, it means the project is no longer relevant and the answer itself does not matter. In such case a link is better than a copy of answer which could itself become stale.  
  > **username_5**: The docs say that DEFAULT_VAULT_PASSWORD_FILE can be used in the config. I'm running Ansible 2.10.1 and this doesn't work. But your clarification (from code) that it should actually be `vault_password_file` specified in the config fixed the situation for me.  
  
  ---
  
  ### Answer by username_2 on 2017-03-29. Score: 3
  
  You can set an environment variable `ANSIBLE_VAULT_PASSWORD_FILE` storing the path the the vault password file. This way you won't have the always use the `--vault-password-file` switch when running a playbook.
  
  This is described in Ansible's Vault documentation, available [here](http://docs.ansible.com/ansible/playbooks_vault.html).
  
  So, add `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt` to your `~/.bash_profile`, source from it and you're ready to go.
  
  If you need different vault passwords for different groups of hosts, then you should do the following:
  
  > Inside of this subdirectory,
  > create two files named vars and vault. Inside of the vars file, define
  > all of the variables needed, including any sensitive ones. Next, copy
  > all of the sensitive variables over to the vault file and prefix these
  > variables with vault\_. You should adjust the variables in the vars
  > file to point to the matching vault\_ variables and ensure that the
  > vault file is vault encrypted.
  
  This is an example for best practices approach for managing sensitive information on per group basis. More information is available in Ansible's documentation [here](http://docs.ansible.com/ansible/playbooks_best_practices.html#best-practices-for-variables-and-vaults) (The above text is copied from there).
  
  > **Comments:**
  > **username_1**: This won't allow a different password per hosts  
  > **username_2**: Are you referring to connection password? Because if you do, what does it have in common with Ansible Vault?  
  > **username_1**: I was referring to the vault password, willing to have different vault password for different groups makes sense (and is the root of the question as far as I understand it).  
  > **username_2**: I didn't understand it that way. I've edited my answer to include that scenario.  
  > **username_1**: seems better. Btw downvote is not mine  
  > **username_0**: `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt`  
  
  ---
  
  