How to use ansible-vault to secure sensitive data

Here in this article we will see how we can use ansible-vault to encrypt plain text data and other sensitive information and use them in the application repository.

Table of Contents

Test Environment

Ansible Controller – Fedora 32 with ansible installed
Ansible Node – Fedora 32 installed

In every infrastructure there will be passwords, private keys, keystores, tokens, secrets and other sensitive and confidential data which we need to secure. There are variours tools available which help in achieving this task like Password Privacy and Vault are a few tools to name.

Features of Ansible Vault

Ansible vault helps in securing confidential information by encrypting and decrypting data
Ansible vault can be used to encrypt variables and files
The encryption and decryption is carried out using one or more passwords which are called vault passwords
Multiple vault passwords can be used and differentiated using the vault ID’s
Encryption with Ansible vault protect only data at rest
vault ID’s add a label to the encrypted content
vault passwords can be stored in files or in a third-party tools such as system keyring or a secret manager

If you are interested in watching the video. Here is the YouTube video on the same step by step procedure outlined below.

Procedure

Step1: Create an Encrypted variable

In this step we are going to create a vault password file which we will use to encrypt the string using the ansible-vault as shown below. The string that we are trying to encrypt in ‘db_password’ and its reference variable name is ‘dbpass’

[admin@ansicontrol ansiblevaultexample]$ cat vaultpass
test@1234

[admin@ansicontrol ansiblevaultexample]$ ansible-vault encrypt_string --vault-password-file vaultpass 'db_password' --name 'dbpass'
dbpass: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66666263623063376161366132643236316334303139353235633836653830343466386464663365
          3232613032373166613165376666386632373530313865370a353765386161633863633831366334
          64343235333064356263663164373866363236363630363936663837373934333361646531653666
          3766386630333361610a346332373238643834313634656532343562633362376233313864366633
          6635
Encryption successful

Step2: Create an Encrypted variable using the vault-id

This is the same step as step1 but we have encrypted the string using the ‘vault-id’ option which help in providing the reference label along with the password file for our encrypted data.

[admin@ansicontrol ansiblevaultexample]$ cat vaultpass
test@1234

[admin@ansicontrol ansiblevaultexample]$ ansible-vault encrypt_string --vault-id proddb@vaultpass 'db_password' --name 'dbpass'
dbpass: !vault |
          $ANSIBLE_VAULT;1.2;AES256;proddb
          31333534613531356265323134643533653262316635666563373039366366336631333164373036
          3137363935356363366432303233373635626133333964320a386533633461393632333665633536
          62313066623361316431316438326130616639626332393466336135653534323934393631373437
          3037613237656432350a663564326130383733326231343636356638373637323866633339386631
          3631
Encryption successful

Step3: Store the encrypted variable content in a vars.yaml file

Let’s store the encrypted variable into a variables file called vars.yaml.

[admin@ansicontrol ansiblevaultexample]$ cat vars.yaml
dbpass: !vault |
          $ANSIBLE_VAULT;1.2;AES256;proddb
          36376132393730303164616462306663393965656662343536643138656666313762356330386662
          6336623035313962386264396666326663336563666162380a336530396537386361323161653861
          36393630656337326236313964623735393134373839386361633938663964363863333431346633
          3566303636336638630a373865373864323066646138303661616430386637396338316432343630
          6132

Step4: Decrypt the variable content using the ansible tool

Lets decrypt the variable encrypted data using the ad-hoc command with debug module as shown below.

[admin@ansicontrol ansiblevaultexample]$ ansible localhost -m debug -a var="dbpass" -e "@vars.yaml" --vault-id proddb@vaultpass
localhost | SUCCESS =&gt; {
    "dbpass": "db_password"
}

Step5: Decrypt the variable content within a playbook using vars_file

Here in this step we are trying to reference the variable file encrypted content in the playbook and decrypt it.

[admin@ansicontrol ansiblevaultexample]$ cat vaultvarexample.yaml
---
- hosts: stack
  remote_user: admin
  vars_files:
    - vars.yaml
  tasks:
    - name: Decrypt the dbpass
      debug:
        var: dbpass

[admin@ansicontrol ansiblevaultexample]$ ansible-playbook vaultvarexample.yaml --vault-id proddb@vaultpass

PLAY [stack] *****************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************
ok: [192.168.47.130]

TASK [Decrypt the dbpass] ****************************************************************************************************
ok: [192.168.47.130] =&gt; {
    "dbpass": "db_password"
}

PLAY RECAP *******************************************************************************************************************
192.168.47.130             : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Step6: Decrypt the variable content within a playbook using vars

[admin@ansicontrol ansiblevaultexample]$ cat vaultvarexample2.yaml
---
- hosts: stack
  remote_user: admin
  vars:
    dbpass: !vault |
          $ANSIBLE_VAULT;1.2;AES256;proddb
          36376132393730303164616462306663393965656662343536643138656666313762356330386662
          6336623035313962386264396666326663336563666162380a336530396537386361323161653861
          36393630656337326236313964623735393134373839386361633938663964363863333431346633
          3566303636336638630a373865373864323066646138303661616430386637396338316432343630
          6132
  tasks:
    - name: Decrypt the dbpass
      debug:
        var: dbpass

[admin@ansicontrol ansiblevaultexample]$ ansible-playbook vaultvarexample2.yaml --vault-id proddb@vaultpass

PLAY [stack] *****************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************
ok: [192.168.47.130]

TASK [Decrypt the dbpass] ****************************************************************************************************
ok: [192.168.47.130] =&gt; {
    "dbpass": "db_password"
}

PLAY RECAP *******************************************************************************************************************
192.168.47.130             : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Hope you enjoyed reading this article. Thank you..

How to use ansible-vault to secure sensitive data