# Accessing encrypted configuration values with a plugin

**URL:** <https://forum.ansible.com/t/accessing-encrypted-configuration-values-with-a-plugin/10504>\
**Category:** Get Help\
**Tags:** config, plugin, ansible-vault\
**Created:** [October 25, 2024, 7:40am UTC](https://forum.ansible.com/t/accessing-encrypted-configuration-values-with-a-plugin/10504 "2024-10-25T07:40:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![usr-cw31jOPI](https://avatars.discourse-cdn.com/v4/letter/u/bbe5ce/32.png) [@usr-cw31jOPI](https://forum.ansible.com/u/usr-cw31jOPI)\
**Post date:** [October 25, 2024, 7:40am UTC](https://forum.ansible.com/t/accessing-encrypted-configuration-values-with-a-plugin/10504/1 "2024-10-25T07:40:01Z")

</div>

### Hello Everybody,

I want to create a _callback plugin_ that emits log messages to an API. That API is secured by some Authorization Header. In Order to securely store the required API Key, I have put it into an encrypted file. The encryption was done using `ansible-vault encrypt ./secrets/log-api.yml`.

To have an easy workflow I have added this to `ansible.cfg`:

```auto
[defaults]
…
vault_password_file = ./pwd.sh
…

```

The question is: How can I access the plain text data of `./secrets/log-api.yml` within the plugin?

Ideally that could be done within `ansible.cfg` like so:

```auto
my_login_plugin_api_key = "{{ lookup( … ) }}"

```

But from what I have heard so far, that is not possible, since there is simply no way to have decryption in that place, isn’t it?

So the question is, how should the decryption happen in the plugin? IMHO that involves those steps:

1. access the value of `vault_password_file` - in best case the result of the the script - within the plugin
2. How to decrypt? Is there any Class / Object / Function for that?

My main Problem is that I am a bloody rookie on that topic and I cannot find any documentation.

THANKS for Help and Directions!

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [October 25, 2024, 7:03pm UTC](https://forum.ansible.com/t/accessing-encrypted-configuration-values-with-a-plugin/10504/2 "2024-10-25T19:03:23Z")

</div>

plugin configuration does not support individual vaults or templating (yet), till then i recommend using an environment variable.  
[https://github.com/ansible/ansible/pull/79244](https://github.com/ansible/ansible/pull/79244)

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [October 26, 2024, 9:49am UTC](https://forum.ansible.com/t/accessing-encrypted-configuration-values-with-a-plugin/10504/3 "2024-10-26T09:49:29Z")

</div>

Many inventory plugins template specific inputs if they look like a template to allow using lookups etc., see for example [community.general/plugins/inventory/linode.py at ccf7f62325d17d794a184ad2ab18e0ca3655b87b · ansible-collections/community.general · GitHub](https://github.com/ansible-collections/community.general/blob/ccf7f62325d17d794a184ad2ab18e0ca3655b87b/plugins/inventory/linode.py#L147-L149)

---

<div class="post-metadata">

**Author:** ![usr-cw31jOPI](https://avatars.discourse-cdn.com/v4/letter/u/bbe5ce/32.png) [@usr-cw31jOPI](https://forum.ansible.com/u/usr-cw31jOPI)\
**Post date:** [November 1, 2024, 5:32am UTC](https://forum.ansible.com/t/accessing-encrypted-configuration-values-with-a-plugin/10504/4 "2024-11-01T05:32:47Z")

</div>

Thanks for clarification!

> [@bcoca](#):
>
> does not support individual vaults or templating (yet)

Does this mean that this is on the Roadmap? Is it already known when this should be there?

---

<div class="post-metadata">

**Author:** ![usr-cw31jOPI](https://avatars.discourse-cdn.com/v4/letter/u/bbe5ce/32.png) [@usr-cw31jOPI](https://forum.ansible.com/u/usr-cw31jOPI)\
**Post date:** [November 1, 2024, 5:43am UTC](https://forum.ansible.com/t/accessing-encrypted-configuration-values-with-a-plugin/10504/5 "2024-11-01T05:43:52Z")

</div>

Thanks a lot for this hint! As I take from that suggestion, the plugin itself is running the code needed to lookup the value, isn’t it? I there anywhere another example that would should the code for decryption using the vault?

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [November 1, 2024, 2:49pm UTC](https://forum.ansible.com/t/accessing-encrypted-configuration-values-with-a-plugin/10504/6 "2024-11-01T14:49:15Z")

</div>

Not on roadmap, just on my personal list.

To implement for specific fields in a plugin, just template (templating decrypts)