# AWX - Can not sync Inventory from Project Source

**URL:** <https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827>\
**Category:** Get Help\
**Tags:** awx\
**Created:** [June 28, 2024, 10:44am UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827 "2024-06-28T10:44:05Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![dkoci](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dkoci/32/815_2.png) [@dkoci](https://forum.ansible.com/u/dkoci)\
**Post date:** [June 28, 2024, 10:44am UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/1 "2024-06-28T10:44:05Z")

</div>

Hi.  
In AWX, I would like to create an inventory from the project source. When I try to sync, I get an error:

> ERROR! Attempting to decrypt but no vault secrets found

The inventory file is not encrypted with Ansible Vault. I have also created credentials for Git and Vault, but I am unable to select them.

AWX operator version: 2.19.0  
AWX version: 24.6.0

 ![Screenshot 2024-06-28 at 12.40.40](https://us1.discourse-cdn.com/ansible/original/2X/a/a61ca20a5c989db5732840452bd95570b55d1601.png)  
 ![Screenshot 2024-06-28 at 12.41.48](https://us1.discourse-cdn.com/ansible/original/2X/b/b4916a80459e0c1ae7287c42380b1e3799e62541.png)

---

<div class="post-metadata">

**Author:** ![iyami5](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iyami5/32/3449_2.png) [@iyami5](https://forum.ansible.com/u/iyami5)\
**Post date:** [June 28, 2024, 6:40pm UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/2 "2024-06-28T18:40:55Z")

</div>

do you an ansible.cfg that might specify a vault file? usually inventory from a project doesn’t require a credential besides selecting the project.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [June 28, 2024, 7:42pm UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/3 "2024-06-28T19:42:48Z")

</div>

@iyami5 Inventory files can be entirely ansible-vault encrypted or have encrypted vars in otherwise plaintext files. Of course, you need to pass the vault decryption information to ansible someway somehow for it to be consumed. However, you don’t want to have that vault password stored in the project itself that the inventory is sourced from.

@dkoci Unfortunately, and this has been part of recent discussions in the AWX community meetings, there are limitations on what and where credentials types can be used. The ansible-vault credential type (as well as custom credential types), for e.g., cannot be used with inventory sources. The only way to work around this is that I am aware of is to add the vault password information to a custom EE, and specify that EE for the inventory source. Then that EE can automatically decrypt the inventory. You don’t necessarily want to bake this into your global EE, as that may conflict with using ansible-vault credential types in the places they can actually be used.

Hopefully in the near future, AWX will support using more/all credential types in more/all contexts.

---

<div class="post-metadata">

**Author:** ![dkoci](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dkoci/32/815_2.png) [@dkoci](https://forum.ansible.com/u/dkoci)\
**Post date:** [June 28, 2024, 10:09pm UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/4 "2024-06-28T22:09:05Z")

</div>

I am a bit confused. Why should I use vault password in case of inventory source? My inventory file and ansible.cfg file are not encrypted with ansible-vault. The only thing which is encrypted is some variable which doesnt have anything to do with ineventory source.

---

<div class="post-metadata">

**Author:** ![iyami5](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iyami5/32/3449_2.png) [@iyami5](https://forum.ansible.com/u/iyami5)\
**Post date:** [July 1, 2024, 1:51am UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/5 "2024-07-01T01:51:56Z")

</div>

probably why its asking you for credentials. Its loading the var or something similar.

---

<div class="post-metadata">

**Author:** ![Angelo\_Gagliardi](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/angelo_gagliardi/32/7505_2.png) [@Angelo\_Gagliardi](https://forum.ansible.com/u/Angelo_Gagliardi)\
**Post date:** [September 2, 2025, 11:25am UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/6 "2025-09-02T11:25:34Z")

</div>

Hi, i tried to do this in my custom ee like this, but did not work out:

Added this in my ansible.cfg:  
vault\_password\_file=/etc/ansible/vid

in the vid file there is the password of the vault, if i run playbook con the custom EE is working decrypting the vault, but if run rhe inventory sync from AWX i am still receiveing this error:

 ![image](https://us1.discourse-cdn.com/ansible/original/2X/3/3ec5f2d1d6a5fd099d95aa00c74c350617a1f3b0.png)

> ## [root@b92812c9655d runner]# cat test.yml
> 
> - hosts: localhost  
> vars\_files: vars.yml  
> tasks:
> - name: debug pippo  
> debug:  
> msg: “{{ pippo }}”  
> [root@b92812c9655d runner]# cat vars.yml  
> $ANSIBLE\_VAULT;1.1;AES256  
> 66633962613736636538393330666436356362653966626537343066323663663262346161633965  
> 3762373631353631396261353330316433646530656430300a363362616263333835626335616162  
> 65613038333331396239313465386362366333636636663463613235626233373666316631323566  
> 3436373838646262620a326463643738646435396662646466333430616236663031366563633163  
> 38343633336632326532643530393364336439346237343861623835306235353239  
> [root@b92812c9655d runner]# ansible-playbook test.yml  
> [WARNING]: No inventory was parsed, only implicit localhost is available  
> [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match ‘all’
> 
> PLAY [localhost] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> ok: [localhost]
> 
> TASK [debug pippo] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> ok: [localhost] =\> {  
> “msg”: “dio”  
> }
> 
> PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> localhost : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

---

<div class="post-metadata">

**Author:** ![Angelo\_Gagliardi](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/angelo_gagliardi/32/7505_2.png) [@Angelo\_Gagliardi](https://forum.ansible.com/u/Angelo_Gagliardi)\
**Post date:** [September 2, 2025, 11:53am UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/7 "2025-09-02T11:53:31Z")

</div>

Oh i see now that hit using **Using /runner/project/ansible.cfg as config file** and not /etc/ansible/ansible.cfg so will not work.

But in my custom EE i don’t have any project folder under /runner:

[root@eb72a1da5eda runner]# ls -lhrt /runner/  
total 8.0K  
-rw-------. 1 root root 419 Aug 29 15:23 vars.yml  
-rw-r–r–. 1 root root 120 Aug 29 15:24 test.yml

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [September 2, 2025, 3:14pm UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/8 "2025-09-02T15:14:27Z")

</div>

Hello! I have learned a thing or two since my earlier post, and believe I am mistaken about something I said previously. I cannot edit the post now though.

First, you _can_ use custom cloud credentials with inventory sources. This is important.

Now, as for using ansible vault encryption _with inventories_, you should not use vault credentials when synchronizing inventories because that fully decrypts them and imports plaintext secrets into AWX/AAP’s inventory. Therefore, vault credentials cannot be used with inventory sources _by design_ for security purposes. The reusability of credential types is still a topic of discussion and likely being addressed in the AWX architecture overhaul, but the vault credential type will still be restricted in any case.

This has the consequence that you cannot synchronize any inventories with vault encrypted _files._ However, you can still sync vault encrypted variables/strings in otherwise plaintext files.

Lastly, if you’re using a custom dynamic inventory plugin in your project sourced inventory, you can use a custom credential type in AWX/AAP to supply the plugin’s authentication secrets without having to save them inside the project, vault encrypted or otherwise. (The only other thing to worry about is making sure your control EE has the required collection plugins and dependencies to work with your custom dynamic inventory type).

* * *

TL;DR

- Don’t pass vault credentials to inventory sources in any way
- Don’t encrypt files in inventory sources (encrypted variables/strings are ok)
- Use custom credential types for authenticating custom dynamic inventory plugins
- Encrypted vars will be decrypted at execution time with vault credential types added to the job templates

* * *

@Angelo_Gagliardi The `/runner/project/ansible.cfg` is an ephemeral file of sorts. When AWX/AAP runs a job, it spins up a new pod/container using ansible-runner to integrate the platform with ansible-core on the EE. The respective AWX/AAP project containing the code for the executing Job Template will be copied to the runner as `/runner/project/` and then run `ansible-playbook my_job_template_playbook.yml` from that directory. If your project contains an `ansible.cfg` file, then that will take precedence over `/etc/ansible/ansible.cfg` as you would normally expect.

---

<div class="post-metadata">

**Author:** ![Angelo\_Gagliardi](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/angelo_gagliardi/32/7505_2.png) [@Angelo\_Gagliardi](https://forum.ansible.com/u/Angelo_Gagliardi)\
**Post date:** [September 2, 2025, 3:46pm UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/9 "2025-09-02T15:46:08Z")

</div>

Hi @Denney-tech,

Thank you for your feedback !

Finally i solved the issue !

I just added that line in my ansible.cfg on my source GIT repository and automatically it copies the file on /runner/project/ansible.cfg so now is working !

I know that we should not have inventory crypted as this case, i will suggest to the customer to make changes and migrate this group\_vars management on the playbook or role side, so we can manage the vault stuff in the job template.

I wish you a wonderful day !

Angelo.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [September 2, 2025, 3:56pm UTC](https://forum.ansible.com/t/awx-can-not-sync-inventory-from-project-source/6827/10 "2025-09-02T15:56:24Z")

</div>

They just need to convert the vars.yml file from an encrypted file to plaintext, and convert the secrets into encrypted strings.

E.g.

```yaml
---
my_secret: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          35663766343830663733653337326235386334306334336466383931323631353636323432396332
          3835653933643962396635356636353061313464393461620a633335346664366362653237653063
          62346638623766306238643838383731616133383733616166336133386461666663356532373862
          6165386465663561320a613264336237646230633138636163353066646132333361303639353531
          3938

```

The vars don’t need to be moved from the inventory into a playbook or role. The inventory just can’t have fully encrypted files.