# Ansible vault -- "ERROR! playbooks must be a list of plays"

**URL:** <https://forum.ansible.com/t/ansible-vault-error-playbooks-must-be-a-list-of-plays/29458>\
**Category:** Ansible Project\
**Created:** [January 17, 2019, 4:35pm UTC](https://forum.ansible.com/t/ansible-vault-error-playbooks-must-be-a-list-of-plays/29458 "2019-01-17T16:35:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 17, 2019, 4:35pm UTC](https://forum.ansible.com/t/ansible-vault-error-playbooks-must-be-a-list-of-plays/29458/1 "2019-01-17T16:35:12Z")

</div>

I wouldn’t be surprised if I am using this incorrectly, but I could use some outside input. Consider the following tree (not in a role):  
.  
├── get\_user\_info.yml

└── vault.yml

vault.yml contents:

`

---

<div class="post-metadata">

**Author:** ![flowerysong1](https://avatars.discourse-cdn.com/v4/letter/f/ecae2f/32.png) [@flowerysong1](https://forum.ansible.com/u/flowerysong1)\
**Post date:** [January 17, 2019, 5:15pm UTC](https://forum.ansible.com/t/ansible-vault-error-playbooks-must-be-a-list-of-plays/29458/2 "2019-01-17T17:15:29Z")

</div>

> I wouldn’t be surprised if I am using this incorrectly, but I could use some outside input. Consider the following tree (not in a role):  
> .  
> ├── get\_user\_info.yml
> 
> └── vault.yml
> 
> **Q1: I had to use vars\_files to get the variables read in. Is that normal? Otherwise, my ansible\_user kept defaulting to “NONE” when executing (as seen under debug level 4)**

Yes. There are cases where variable files are automatically loaded (e.g. roles, group\_vars) but random YAML files adjacent to the playbook is not one of those cases.

> I execute the playbook as follows (which works) but get an error toward the end (in the play recap):
> 
> `ansible-playbook ./get_user_info.yml --vault-id @prompt vault.yml -i /etc/ansible/inventory/windows -e user=someuser-e host=myserver`  
> `
> 
> ERROR! playbooks must be a list of plays
> 
> `

You ran, disregarding the other flags, `ansible-playbook get_user_info.yml vault.yml`, so Ansible attempted to execute those files as playbooks. The second one is not a playbook so it errored out.

---

<div class="post-metadata">

**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\
**Post date:** [January 18, 2019, 5:13am UTC](https://forum.ansible.com/t/ansible-vault-error-playbooks-must-be-a-list-of-plays/29458/3 "2019-01-18T05:13:23Z")

</div>

It’s a lot easier if you just encrypt the value and not the whole file so you can find where a variable is defined.  
For example

```auto
ansible-vault encrypt_string --vault-id dev@password 'foooodev' --name 'the_dev_secret'

```

Result:

```auto
the_dev_secret: !vault |
          $ANSIBLE_VAULT;1.2;AES256;dev
          30613233633461343837653833666333643061636561303338373661313838333565653635353162
          3263363434623733343538653462613064333634333464660a663633623939393439316636633863
          61636237636537333938306331383339353265363239643939666639386530626330633337633833
          6664656334373166630a363736393262666465663432613932613036303963343263623137386239
          6330

```

[https://docs.ansible.com/ansible/latest/user\_guide/vault.html](https://docs.ansible.com/ansible/latest/user_guide/vault.html)

However if you must encrypt the whole file,  
You can do the following

1. create group\_vars/all.yml and put the following  
ansible\_user: someguy

ansible\_password: “{{ vault\_ansible\_password }}”

1. create group\_vars/vault.yml with the encrypted value of vault\_ansible\_password

Then you should be able to run  
ansible-playbook ./get\_user\_info.yml -i some\_inventory