How do you handle sensitive data like passwords in Ansible?

Ansible Vault is the primary method for encrypting sensitive data like passwords, API keys, and certificates.

Basic Vault operations:

# Encrypt a file
ansible-vault encrypt secrets.yml

# Decrypt a file
ansible-vault decrypt secrets.yml

# Edit encrypted file
ansible-vault edit secrets.yml

# Run playbook with vault password
ansible-playbook site.yml --ask-vault-pass

# Use vault password file
ansible-playbook site.yml --vault-password-file .vault_pass

Encrypting specific variables:

# vars.yml
username: john
password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  66386439653762356265343432393730...

Best practices:

• Store vault password in a file with restricted permissions (chmod 600)
• Use separate vault files for different environments
• Encrypt only sensitive variables, not entire playbooks
• Use no_log: true in tasks handling sensitive data
• Never commit vault passwords to version control