# Ansible reads all files in host\_vars and group\_vars instead of just the ones for the specified hosts

**URL:** <https://forum.ansible.com/t/ansible-reads-all-files-in-host-vars-and-group-vars-instead-of-just-the-ones-for-the-specified-hosts/21464>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [May 17, 2016, 9:11pm UTC](https://forum.ansible.com/t/ansible-reads-all-files-in-host-vars-and-group-vars-instead-of-just-the-ones-for-the-specified-hosts/21464 "2016-05-17T21:11:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Martin](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Andrew\_Martin](https://forum.ansible.com/u/Andrew_Martin)\
**Post date:** [May 17, 2016, 9:11pm UTC](https://forum.ansible.com/t/ansible-reads-all-files-in-host-vars-and-group-vars-instead-of-just-the-ones-for-the-specified-hosts/21464/1 "2016-05-17T21:11:14Z")

</div>

Hello,

I am running ansible 2.0.2 on Ubuntu 14.04. I have several vaulted host-specific or group-specific files in host\_vars or group\_vars, so whenever I run “ansible-playbook”, I pass the “–ask-vault” option. I noticed some odd behavior - if I run with “–ask-vault” and strace the “ansible-playbook” process, I see that it needs to read (and thus decrypt if vaulted) ALL of the files in host\_vars and group\_vars, not just the host\_vars/myhost or host\_vars/mygroup specific files that apply to the hosts I’m running on (as defined in the inventory file). How can I configure ansible to only read the specific host\_vars and group\_vars files that it needs, rather than this entire directory every time? Because it is reading every file, it takes a lot longer (since it has to decrypt all of the vault files, even ones that aren’t used).

Thanks!

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [May 17, 2016, 9:13pm UTC](https://forum.ansible.com/t/ansible-reads-all-files-in-host-vars-and-group-vars-instead-of-just-the-ones-for-the-specified-hosts/21464/2 "2016-05-17T21:13:33Z")

</div>

There is no current way. The way ansible inventory works is that all inventory files, including host vars and group vars are read and parsed before ansible really starts doing much of anything.

There also isn’t any way to know whether you may try to access an vaulted var for another host or group, that isn’t targeted by the play, which is often done.

---

<div class="post-metadata">

**Author:** ![Andrew\_Martin](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Andrew\_Martin](https://forum.ansible.com/u/Andrew_Martin)\
**Post date:** [May 17, 2016, 9:22pm UTC](https://forum.ansible.com/t/ansible-reads-all-files-in-host-vars-and-group-vars-instead-of-just-the-ones-for-the-specified-hosts/21464/3 "2016-05-17T21:22:27Z")

</div>

Okay thanks for the clarification. So there’s no way to only give access to vaulted files in host\_vars or group\_vars to certain users (but let other users run playbooks that don’t require a vault file)?