# Ansible vault without temp files

**URL:** <https://forum.ansible.com/t/ansible-vault-without-temp-files/35439>\
**Category:** Ansible Project\
**Created:** [June 30, 2021, 12:08am UTC](https://forum.ansible.com/t/ansible-vault-without-temp-files/35439 "2021-06-30T00:08:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tiglath](https://avatars.discourse-cdn.com/v4/letter/t/df705f/32.png) [@Tiglath](https://forum.ansible.com/u/Tiglath)\
**Post date:** [June 30, 2021, 12:08am UTC](https://forum.ansible.com/t/ansible-vault-without-temp-files/35439/1 "2021-06-30T00:08:46Z")

</div>

Quick question, please.

A playbook. for each host generates a random password, sets it as root password on the host and stores, “:\< pwd\>” in local Ansible vault file.

How can I add new entries to the vault without creating a decrypted file ON DISK.

Ideally, I’d pipe the output of ‘ansible-vault decrypt’ output into a script that adds new data and then pipes it back to ansible-vault encrypt, so that the plain text only exists in memory.

Thanks

---

<div class="post-metadata">

**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\
**Post date:** [June 30, 2021, 7:53am UTC](https://forum.ansible.com/t/ansible-vault-without-temp-files/35439/2 "2021-06-30T07:53:55Z")

</div>

Short answer

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [June 30, 2021, 2:04pm UTC](https://forum.ansible.com/t/ansible-vault-without-temp-files/35439/3 "2021-06-30T14:04:41Z")

</div>

now in filter:  
[https://github.com/ansible/ansible/pull/74998](https://github.com/ansible/ansible/pull/74998)

---

<div class="post-metadata">

**Author:** ![Tiglath](https://avatars.discourse-cdn.com/v4/letter/t/df705f/32.png) [@Tiglath](https://forum.ansible.com/u/Tiglath)\
**Post date:** [June 30, 2021, 4:35pm UTC](https://forum.ansible.com/t/ansible-vault-without-temp-files/35439/4 "2021-06-30T16:35:43Z")

</div>

Thanks for taking the time.

This is what I have:

What’s missing is the code to do the actions in capitals.

- hosts: all  
gather\_facts: no  

tasks:

- name: generate random password.  
delegate\_to: localhost  
command: “/home/ec2-user/genpwd.py”  
register: pwd

- name: Update root user’s password  
become: true  
user:  
name: root  
password: “{{ pwd.stdout | password\_hash(‘sha512’)}}”  
\<IF SUCCESSFUL ADD ‘:’ TO DICTIONARY\>

- post\_tasks:  
delegate\_to: localhost

\<DECRYPT VAULT TO MEMORY, APPEND DICT AND ENCRYPT BACK TO VAULT\>

Many thanks.