# Ansible vault best practice with AWX **URL:** \ **Category:** AWX Project\ **Tags:** aws, awx\ **Created:** [February 19, 2021, 4:40pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655 "2021-02-19T16:40:25Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Ted\_Underhill](https://avatars.discourse-cdn.com/v4/letter/t/74df32/32.png) [@Ted\_Underhill](https://forum.ansible.com/u/Ted_Underhill)\ **Post date:** [February 19, 2021, 4:40pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/1 "2021-02-19T16:40:25Z")
Hi I currently have existing playbooks which use vault files in group\_vars (ie. group\_vars/dev/vault-all.yml). I’ve been having problems integrating my existing playbooks into AWX. When adding a source to my inventory via Sourced from a Project/Inventory file, I get an error “The vault password file was not found”. After much googling, I’m not really clear what is the best practice for using vaults within AWX. It seems that my current method isn’t supported by AWS 17.0.1. Some suggestions were to encrypt each value separately which would be painful. Found this [post](https://serverfault.com/questions/878320/how-to-use-existing-vault-files-in-ansible-tower)in Stackoverflow but its 3 years old. So my questions: - Are my current playbooks outside of AWX using best practice for vaults? Should the secrets all be in one encrypted file? Or should they be individually vaulted? - How do I get past the missing vault password file error in AWX? One other kind of off topic question: Is there a best practice in separating inventories from playbooks? Each of my playbook repos have their own inventory files with some duplication. In AWX, I was hoping to see a git repo as a source for inventory. Thanks! ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [February 19, 2021, 4:43pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/2 "2021-02-19T16:43:09Z")
When yoy run a play book in awx you tie that to a job template. In that job template you can attach a ‘credential object’ which is a vault credential. That vault credential is your vault password. Hth. Look under the credential resource on the left in awx. You can create a vault credential there ---
**Author:** ![Ted\_Underhill](https://avatars.discourse-cdn.com/v4/letter/t/74df32/32.png) [@Ted\_Underhill](https://forum.ansible.com/u/Ted_Underhill)\ **Post date:** [February 19, 2021, 4:53pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/3 "2021-02-19T16:53:55Z")
Thanks for the quick reply. I tried adding a vault cred to my template and still got the same error. From the way the UI is designed, it looks like Inventories is independent from Templates. When adding an inventory file, there is no reference to the template so the inventories function doesn’t know to use it. ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [February 19, 2021, 4:55pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/4 "2021-02-19T16:55:58Z")
Where is the vault file? How are you tieing it in together? You are right It is very different from the command line version of ansible ---
**Author:** ![Ted\_Underhill](https://avatars.discourse-cdn.com/v4/letter/t/74df32/32.png) [@Ted\_Underhill](https://forum.ansible.com/u/Ted_Underhill)\ **Post date:** [February 19, 2021, 5:07pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/5 "2021-02-19T17:07:31Z")
My playbooks are organized something like this (based on [this](https://docs.ansible.com/ansible/2.9/user_guide/playbooks_best_practices.html#alternative-directory-layout)): group\_vars/ dev/ prod/ inventories/ prod/ hosts group\_vars/ dev/ hosts playbook.yml roles roleA roleB\ ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [February 19, 2021, 5:14pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/6 "2021-02-19T17:14:22Z")
Under inventory There is a button called sources. You can pull in your inventory through a project. ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [February 19, 2021, 5:22pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/7 "2021-02-19T17:22:27Z")
I reread what you are doing. I did mine a bit differently. I used redcop-ansible tower configuration files to define my vars and such. I then used include\_vars in my play book to pull them in. By doing it this way I can then use the job template to include my vault credentials. Doing it your way means that there is not really a way to include vaulted credentials UNLESS its included in the include vars in the playbook and has some kind of way to pull in from the credential part in the job template…if that makes sense, happy to explain further… ---
**Author:** ![Ted\_Underhill](https://avatars.discourse-cdn.com/v4/letter/t/74df32/32.png) [@Ted\_Underhill](https://forum.ansible.com/u/Ted_Underhill)\ **Post date:** [February 19, 2021, 6:44pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/8 "2021-02-19T18:44:33Z")
I am pulling in the inventory file through a project. The missing vault file error happens when that inventory file is synced. Think I understand how you are doing it. That method is described in the Stackoverflow question ---
**Author:** ![Ted\_Underhill](https://avatars.discourse-cdn.com/v4/letter/t/74df32/32.png) [@Ted\_Underhill](https://forum.ansible.com/u/Ted_Underhill)\ **Post date:** [February 19, 2021, 9:30pm UTC](https://forum.ansible.com/t/ansible-vault-best-practice-with-awx/34655/9 "2021-02-19T21:30:57Z")
For anyone who may run into this in the future, I followed this [suggestion](https://github.com/ansible/awx/issues/223#issuecomment-677830978)and it works.