# Access Vault Pass from inside dynamic inventory

**URL:** <https://forum.ansible.com/t/access-vault-pass-from-inside-dynamic-inventory/19245>\
**Category:** Ansible Project\
**Created:** [September 12, 2015, 2:19am UTC](https://forum.ansible.com/t/access-vault-pass-from-inside-dynamic-inventory/19245 "2015-09-12T02:19:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tom\_Paine1](https://avatars.discourse-cdn.com/v4/letter/t/3da27b/32.png) [@Tom\_Paine1](https://forum.ansible.com/u/Tom_Paine1)\
**Post date:** [September 12, 2015, 2:19am UTC](https://forum.ansible.com/t/access-vault-pass-from-inside-dynamic-inventory/19245/1 "2015-09-12T02:19:21Z")

</div>

I have an executable python file that produces an inventory.

Can I access the vault password passed on the command line from the script, or is the script run in isolation from everything else?

---

<div class="post-metadata">

**Author:** ![Kumar4](https://avatars.discourse-cdn.com/v4/letter/k/d9b06d/32.png) [@Kumar4](https://forum.ansible.com/u/Kumar4)\
**Post date:** [April 12, 2019, 3:34pm UTC](https://forum.ansible.com/t/access-vault-pass-from-inside-dynamic-inventory/19245/2 "2019-04-12T15:34:15Z")

</div>

Did you find answer to your question? I am looking for the same solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [April 18, 2019, 4:13pm UTC](https://forum.ansible.com/t/access-vault-pass-from-inside-dynamic-inventory/19245/3 "2019-04-18T16:13:47Z")

</div>

No, inventory scripts cannot use vault features, they are an 'external  
script' Ansible runs.

Inventory plugins can by default, they will automatically unvault  
their inventory source file, since these are plugins that run  
internally in Ansible.

---

<div class="post-metadata">

**Author:** ![Manuel\_Deschambault](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@Manuel\_Deschambault](https://forum.ansible.com/u/Manuel_Deschambault)\
**Post date:** [July 11, 2023, 10:12pm UTC](https://forum.ansible.com/t/access-vault-pass-from-inside-dynamic-inventory/19245/4 "2023-07-11T22:12:24Z")

</div>

I have a question. I prompt for the vault password with “vars\_prompt”. I then pass this variable to every role I use so I can use it to encrypt/decrypt. When I do:

- name: Test a static file decrypt  
delegate\_to: localhost  
copy:  
content: “{{ lookup(‘ansible.builtin.file’, ‘/home/ansible//test.txt’) | ansible.builtin.unvault(vault\_passwd) }}”  
dest: “/home/ansible/test.txt”

I get the following error:

“Attempting to decrypt but no vault secrets found”

I tried adding “decrypt: no” to the copy module, as I figured that the copy module tried to decrypt the file even though that should already been done via ansible.builtin.unvault, but it changes nothing.  
Still get the same error. I tested that the vault\_password variable does indeed carry the password.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [July 17, 2023, 1:46pm UTC](https://forum.ansible.com/t/access-vault-pass-from-inside-dynamic-inventory/19245/5 "2023-07-17T13:46:58Z")

</div>

The 'file' lookup has a builtin unvault function, which is what is  
failing, before you get to the unvault filter. A workaround is using  
the `pipe` lookup to `cat` the file.

We really should add one of 2 switches 1 to avoid decrypting (like  
copy has) or just return the encrypted content when ignoring errors.