# Ansible-Vault filter, module extensions

**URL:** <https://forum.ansible.com/t/ansible-vault-filter-module-extensions/32841>\
**Category:** Ansible Developer\
**Created:** [May 4, 2020, 11:48am UTC](https://forum.ansible.com/t/ansible-vault-filter-module-extensions/32841 "2020-05-04T11:48:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![j1f0x](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@j1f0x](https://forum.ansible.com/u/j1f0x)\
**Post date:** [May 4, 2020, 11:48am UTC](https://forum.ansible.com/t/ansible-vault-filter-module-extensions/32841/1 "2020-05-04T11:48:41Z")

</div>

I’d like to have a possibilty to generate vault file from within ansible playbooks.

The particular problem is to fetch sensitive data for remote host and store this data encrypted on the local host.

on pypy ansible-vault is available, so there is no need to duplicatie the functionality of encryption and decryption.

What do you think about

- Implementing a filter plugin

set\_fact:  
encrypted\_data: “{{ my\_data | to\_vault(‘~/.vault/ansible-vault’) }}”

- Extend Modules ‘copy’, ‘fetch’ to allow encryption during copy
- encrypt: [src | dest]

What are your thougths about that?

KR  
Josef

---

<div class="post-metadata">

**Author:** ![afeller](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@afeller](https://forum.ansible.com/u/afeller)\
**Post date:** [May 4, 2020, 11:57am UTC](https://forum.ansible.com/t/ansible-vault-filter-module-extensions/32841/2 "2020-05-04T11:57:01Z")

</div>

Interesting idea but I’d imagine going with a custom module instead of a filter plugin as you’d potentially want to store / update multiple variables within the vault.

Some logistical questions to ask yourself in your implementation:

1. Does this module support vault ids?
2. Can the password of the vault be the same or different from one used with running ansible itself?
3. Does this overwrite the vault with subsequent calls or should it merge new variables with existing content? Does it provide an option to overwrite?  
Lastly, I recommend looking at the [Ansible code the interacts with vaults](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/vault.py) to see which modules you can import to make this happen without boiling the ocean.

HTH,  
Andy

---

<div class="post-metadata">

**Author:** ![j1f0x](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@j1f0x](https://forum.ansible.com/u/j1f0x)\
**Post date:** [May 5, 2020, 2:21am UTC](https://forum.ansible.com/t/ansible-vault-filter-module-extensions/32841/3 "2020-05-05T02:21:20Z")

</div>

Hi Andy

Thanks for feedback. I’m going to analyse all the stuff.

Josef