# Ansible Vault **URL:** \ **Category:** Ansible Project\ **Created:** [March 30, 2016, 4:25pm UTC](https://forum.ansible.com/t/ansible-vault/21022 "2016-03-30T16:25:50Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [March 30, 2016, 4:25pm UTC](https://forum.ansible.com/t/ansible-vault/21022/1 "2016-03-30T16:25:50Z")
Hi I am am trying to setup Ansible vault and running into errors. In my /etc/ansible/group\_vars folder I have muliple vars files for specific server groups in the host files. These vars files (winservers.yml) have the servers login details…for example: ansible\_ssh\_user: Administrator ansible\_ssh\_pass: PASSWORD ansible\_ssh\_port: 5986 ansible\_connection: winrm What I want to do is use vault to not have those passwords visable in these vars files. So what I did is create a vault.yml file (using ansible-vault) in the group\_vars folder. I then added the variables in the file ---
**Author:** ![Jorge\_L](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jorge\_L](https://forum.ansible.com/u/Jorge_L)\ **Post date:** [March 30, 2016, 4:44pm UTC](https://forum.ansible.com/t/ansible-vault/21022/2 "2016-03-30T16:44:48Z")
What about: ansible\_ssh\_pass: “{{ winservers\_password }}” ? ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [March 30, 2016, 4:51pm UTC](https://forum.ansible.com/t/ansible-vault/21022/3 "2016-03-30T16:51:21Z")
Hi Its definitely a step further! But I get the following error now: fatal: [10.10.3.168]: FAILED! =\> {“failed”: true, “msg”: “‘winservers\_password’ is undefined”} Its as if it doesn’t know where to look for the variable? Should it just know to ready the variable from the ‘vault.yml’ file? ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [March 30, 2016, 4:53pm UTC](https://forum.ansible.com/t/ansible-vault/21022/4 "2016-03-30T16:53:36Z")
can you create the directory /etc/ansible/group\_vars folder/all and put everything in it instead of /etc/ansible/group\_vars folder? ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [March 30, 2016, 4:59pm UTC](https://forum.ansible.com/t/ansible-vault/21022/5 "2016-03-30T16:59:32Z")
Hi Arbab So currently I have /etc/ansible/group\_vars and in that folder I have the following: azureservers.yml vault.yml windows.yml winservers.yml Do you want me to now create the following folder, /etc/ansible/group\_vars/all Or must it be a new group\_vars folder structure, /etc/ansible/group\_vars folder/all And then copy those yml file into that ‘all’ folder? ---
**Author:** ![Arbab\_Nazar](https://avatars.discourse-cdn.com/v4/letter/a/49beb7/32.png) [@Arbab\_Nazar](https://forum.ansible.com/u/Arbab_Nazar)\ **Post date:** [March 30, 2016, 6:53pm UTC](https://forum.ansible.com/t/ansible-vault/21022/6 "2016-03-30T18:53:23Z")
just create the all directory inside the /etc/ansible/group\_vars/ and move the azureservers.yml vault.yml windows.yml winservers.yml inside it. ---
**Author:** ![Uditha\_Desilva](https://avatars.discourse-cdn.com/v4/letter/u/f475e1/32.png) [@Uditha\_Desilva](https://forum.ansible.com/u/Uditha_Desilva)\ **Post date:** [March 30, 2016, 9:52pm UTC](https://forum.ansible.com/t/ansible-vault/21022/7 "2016-03-30T21:52:02Z")
“vault.yml” is not a magical filename, you still need to use a “use\_vars:” task to pull in the contents of that file. If you have provided the vault password (either via --ask-vault or via a vault password file), then that file will be decrypted and the variables within it will be evaluated. ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [March 30, 2016, 10:28pm UTC](https://forum.ansible.com/t/ansible-vault/21022/8 "2016-03-30T22:28:05Z")
That complete contradicts the 'one file per group' scheme that is the basis for the group\_vars folder. Just copying the vault.yml file into that folder or renaming it to /etc/ansible/group\_vars/all.yml would help IMHO. Of course this is only sensible if the values are for all hosts, otherwise creating an encrypted file e.g. azureservers.yml would be the better option. Johannes ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [March 31, 2016, 1:53am UTC](https://forum.ansible.com/t/ansible-vault/21022/9 "2016-03-31T01:53:24Z")
you can also do this: group\_vars/\/vault.yml You can have multiple files on a group named dir. ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [March 31, 2016, 7:33am UTC](https://forum.ansible.com/t/ansible-vault/21022/10 "2016-03-31T07:33:35Z")
Of course, but I thought the files the OP mentioned were for different groups... Johannes ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [March 31, 2016, 8:56am UTC](https://forum.ansible.com/t/ansible-vault/21022/11 "2016-03-31T08:56:47Z")
Hi Mark, Bit late to this one but as well as using group\_vars folders I’d suggest organizing things so that you aren’t trying to do this: ansible\_ssh\_pass: {{ winservers\_password }} so you can avoid a vault lookup of a var. Instead I’d put the ansible\_ssh\_pass: ACTUAL\_SECRET\_PASSWORD into a separate file and vault that, then use the child groups mechanism to include the var in whatever groups you need. Oh yeah, while you are orgainising things, might be worth switching to the new names e.g. ansible\_user instead of ansible\_ssh\_user as I imagine the old names will get deprecated at some point. HTH Jon ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [March 31, 2016, 11:18am UTC](https://forum.ansible.com/t/ansible-vault/21022/12 "2016-03-31T11:18:12Z")
Hi guys Thank you so much for all your feedback. Getting a little confused as to what to do now though. Do I create the following folder /etc/ansible/group\_vars/all and just copy all the files into that folder? Will that solve the problem? Jon - Im not exactly sure what you mean by, “into a separate file and vault that, then use the child groups mechanism to include the var in whatever groups you need.” Can you not just have one vault file with all variables that you want secure, and then just refer to those variables in all your playbooks? Cheers ---
**Author:** ![Arbab\_Nazar](https://avatars.discourse-cdn.com/v4/letter/a/49beb7/32.png) [@Arbab\_Nazar](https://forum.ansible.com/u/Arbab_Nazar)\ **Post date:** [March 31, 2016, 11:27am UTC](https://forum.ansible.com/t/ansible-vault/21022/13 "2016-03-31T11:27:12Z")
Mark, just give a try with the /etc/ansible/group\_vars/all and don’t for to add the --ask-vault-pass to your playbook ---
**Author:** ![Mike\_Biancaniello](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@Mike\_Biancaniello](https://forum.ansible.com/u/Mike_Biancaniello)\ **Post date:** [March 31, 2016, 2:39pm UTC](https://forum.ansible.com/t/ansible-vault/21022/14 "2016-03-31T14:39:09Z")
Every item in group\_vars/ is named to match a group name. These items can be either files (my\_group, my\_group.yml) or directories (my\_group/). If it is a directory, then it works similarly to a .d/ directory where all of the files in that dir are imported. These are equivilent structures: 1. One file: group\_vars/group1.yml `