<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">ansible-vault</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.3.0.0
  config file = 
  configured module search path = Default w/o overrides
  python version = 2.7.13 (default, Dec 18 2016, 07:03:39) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]"><pre class="notranslate"><code class="notranslate">ansible 2.3.0.0
  config file = 
  configured module search path = Default w/o overrides
  python version = 2.7.13 (default, Dec 18 2016, 07:03:39) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">n/a</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">Have reproduced this on latest OS X and CentOS 6.8 Docker image</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">ansible-vault is no longer using the <code class="notranslate">-</code> argument for --output. Based on the output, it seems like it thinks the <code class="notranslate">-</code> is the literal name of the output file.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">echo myPassword | ansible-vault encrypt  --output=-</p>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">On &lt; 2.3, the following output is seen:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Vault password: 
$ANSIBLE_VAULT;1.1;AES256
32663537353138656134386139666466306466316530653432353734386632343531663132636539
3635303239373734303161613630663163613264303730350a633466376433363934356534326464
32663736393037313830316336363339633235383464313030653264613833386664346130363934
3234346139656432300a633738383737623162313930663462636665353332376265633361356336
6565
Encryption successful"><pre class="notranslate"><code class="notranslate">Vault password: 
$ANSIBLE_VAULT;1.1;AES256
32663537353138656134386139666466306466316530653432353734386632343531663132636539
3635303239373734303161613630663163613264303730350a633466376433363934356534326464
32663736393037313830316336363339633235383464313030653264613833386664346130363934
3234346139656432300a633738383737623162313930663462636665353332376265633361356336
6565
Encryption successful
</code></pre></div>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">On 2.3, the following output is seen:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="New Vault password: 
Confirm New Vault password: 
ERROR! [Errno 2] No such file or directory: '/Users/rchsu/cwd/-'"><pre class="notranslate"><code class="notranslate">New Vault password: 
Confirm New Vault password: 
ERROR! [Errno 2] No such file or directory: '/Users/rchsu/cwd/-'
</code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">ansible-vault</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="→ ansible --version
ansible 2.2.1.0
  config file = 
  configured module search path = Default w/o overrides"><pre class="notranslate"><code class="notranslate">→ ansible --version
ansible 2.2.1.0
  config file = 
  configured module search path = Default w/o overrides
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<p dir="auto">I have no unique configuration</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>

<p dir="auto">OS X El Capitan 10.11.6</p>
<h5 dir="auto">SUMMARY</h5>

<p dir="auto">If the first/only file I encrypt via ansible-vault is a json file (the json credentails downloaded from GCE for a service account), then ansible-playbook will not prompt for a vault password and <code class="notranslate">--ask-vault-pass</code> is not required to run a playbook successfully.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>

<p dir="auto">I imagine this could work similar with anything that involves a json file, but here is what I did.</p>
<ol dir="auto">
<li>Download a GCE credentials .json file (I imagine this would work with aws or anything that uses json?).</li>
<li>Move it to be <code class="notranslate">group_vars/devboxes/credentials.json</code></li>
<li>Create the <code class="notranslate">create_vm.yml</code> playbook below and the <code class="notranslate">group_vars/devboxes/vars.yml</code> listed below.</li>
<li>Run the playbook at least once successfully <code class="notranslate">ansible-playbook create_vm.yml</code> before encrypting.
<ul dir="auto">
<li>When I tried this on another machine, it failed until I ran the playbook once with a decrypted creds.json, but then after encrypting the below behavior still occurred)</li>
</ul>
</li>
<li><code class="notranslate">ansible-vault encrypt group_vars/devboxes/credentials.json</code></li>
<li>Run the playbook again the same as in step 4
<ul dir="auto">
<li>Note that <code class="notranslate">--ask-vault-pass</code> was not required, but the decryption still occurred.</li>
</ul>
</li>
<li>(Optional) If you modify the credentials.json file (after decrypting it) and then re-encrypt it, the playbook will fail. So it doesn't seem to be storing a cached file anywhere, it just does not seem to recognize this playbook as requiring a password.</li>
</ol>

<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="# create_vm.yml playbook
- hosts: localhost
  connection: local
  vars_files:
    - &quot;group_vars/devboxes/vars.yml&quot;
  gather_facts: False
  tasks:
  - name: &quot;Creating virtual machine&quot;
    gce:
      instance_names: my-test-instance1
      zone: us-central1-a
      machine_type: g1-small
      image: debian-8
      state: present
      service_account_email: &quot;{{ gce_service_account_email }}&quot;
      credentials_file: &quot;{{ gce_credentials_file }}&quot;
      project_id: &quot;{{ gce_project_id }}&quot;
    register: gce


# group_vars/devboxes/vars.yml
devboxes_gce_project_id: &lt;GCE_PROJECT_ID&gt;
devboxes_gce_service_account_email: &lt;GCE_SERVICE_EMAIL&gt;
devboxes_gce_credentials_file: &quot;{{ playbook_dir }}/group_vars/devboxes/credentials.json&quot;"><pre class="notranslate"><span class="pl-c"><span class="pl-c">#</span> create_vm.yml playbook</span>
- <span class="pl-ent">hosts</span>: <span class="pl-s">localhost</span>
  <span class="pl-ent">connection</span>: <span class="pl-s">local</span>
  <span class="pl-ent">vars_files</span>:
    - <span class="pl-s"><span class="pl-pds">"</span>group_vars/devboxes/vars.yml<span class="pl-pds">"</span></span>
  <span class="pl-ent">gather_facts</span>: <span class="pl-c1">False</span>
  <span class="pl-ent">tasks</span>:
  - <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">"</span>Creating virtual machine<span class="pl-pds">"</span></span>
    <span class="pl-ent">gce</span>:
      <span class="pl-ent">instance_names</span>: <span class="pl-s">my-test-instance1</span>
      <span class="pl-ent">zone</span>: <span class="pl-s">us-central1-a</span>
      <span class="pl-ent">machine_type</span>: <span class="pl-s">g1-small</span>
      <span class="pl-ent">image</span>: <span class="pl-s">debian-8</span>
      <span class="pl-ent">state</span>: <span class="pl-s">present</span>
      <span class="pl-ent">service_account_email</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ gce_service_account_email }}<span class="pl-pds">"</span></span>
      <span class="pl-ent">credentials_file</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ gce_credentials_file }}<span class="pl-pds">"</span></span>
      <span class="pl-ent">project_id</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ gce_project_id }}<span class="pl-pds">"</span></span>
    <span class="pl-ent">register</span>: <span class="pl-s">gce</span>


<span class="pl-c"><span class="pl-c">#</span> group_vars/devboxes/vars.yml</span>
<span class="pl-ent">devboxes_gce_project_id</span>: <span class="pl-s">&lt;GCE_PROJECT_ID&gt;</span>
<span class="pl-ent">devboxes_gce_service_account_email</span>: <span class="pl-s">&lt;GCE_SERVICE_EMAIL&gt;</span>
<span class="pl-ent">devboxes_gce_credentials_file</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ playbook_dir }}/group_vars/devboxes/credentials.json<span class="pl-pds">"</span></span></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<p dir="auto">I expected to ansible to give me a warning that a file was not decrypted, and require a password prompt or password file.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>

<p dir="auto">I was not prompted for a password and the play completed successfully.</p>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="→ ansible-vault encrypt group_vars/devboxes/creds.json
Vault password: 
Encryption successful

→ ansible-playbook create_vm.yml                      

PLAY [localhost] ***************************************************************

TASK [Actually creating machine] ***********************************************
changed: [localhost]

PLAY RECAP *********************************************************************
localhost                  : ok=1    changed=1    unreachable=0    failed=0   "><pre class="notranslate"><code class="notranslate">→ ansible-vault encrypt group_vars/devboxes/creds.json
Vault password: 
Encryption successful

→ ansible-playbook create_vm.yml                      

PLAY [localhost] ***************************************************************

TASK [Actually creating machine] ***********************************************
changed: [localhost]

PLAY RECAP *********************************************************************
localhost                  : ok=1    changed=1    unreachable=0    failed=0   
</code></pre></div>