# AWX credentials vs credentials type

**URL:** <https://forum.ansible.com/t/awx-credentials-vs-credentials-type/2921>\
**Category:** Get Help\
**Tags:** hashi-vault, awx\
**Created:** [December 15, 2023, 9:32am UTC](https://forum.ansible.com/t/awx-credentials-vs-credentials-type/2921 "2023-12-15T09:32:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\
**Post date:** [December 15, 2023, 9:32am UTC](https://forum.ansible.com/t/awx-credentials-vs-credentials-type/2921/1 "2023-12-15T09:32:24Z")

</div>

Hi,

I’ve successfully configured a HashiCorp Vault Secret Lookup Credentials within AWX.  
I simply provide my vault url, secret\_id and role\_id, CA cert and select API v2.

Within the credentials settings, I’m able to successfully test to retrieve a secret/key from this credential as you can see here

 ![awx_stackov](https://us1.discourse-cdn.com/ansible/original/2X/0/078b918a80373bceebda0774b0820d7549b2a550.png)

However, it’s not possible to use this credentials when I create a new Job template as you can see below, there’s no Hashicorp Vault credentials available.

 ![credentials_awx](https://us1.discourse-cdn.com/ansible/original/2X/c/c67244b3b9b596f0a223f647ff6945e5c84e9b86.png)

Is there a limit or a bug of AWX ? or does the Hashicorp Credentials are only valid from an AWX instance perspective ? (and though, not to be used within a project)

Also, my Ansible project are coded to retrieve `ansible_hashi_vault_token` and then, the playbook can ask Vault different keys based on different secrets (all within kv/ )

Thanks a lot  
Gael

---

<div class="post-metadata">

**Author:** ![golakiyaalice](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/golakiyaalice/32/1046_2.png) [@golakiyaalice](https://forum.ansible.com/u/golakiyaalice)\
**Post date:** [December 15, 2023, 12:00pm UTC](https://forum.ansible.com/t/awx-credentials-vs-credentials-type/2921/2 "2023-12-15T12:00:28Z")

</div>

What version of AWX you are using?  
This feature seems to be added.

Warm Regards,  
Alice Golakiya

---

<div class="post-metadata">

**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\
**Post date:** [December 15, 2023, 12:35pm UTC](https://forum.ansible.com/t/awx-credentials-vs-credentials-type/2921/3 "2023-12-15T12:35:20Z")

</div>

Hi, that’s nice to heard ! do you know if there’s a pull request about ?

My awx-operator version is : 2.9.0  
My AWX instance version is : AWX 23.5.1

Basically I found a “dirty” workaround, setup HC Vault url + token as a variable to every project (so token is not encrypted), it makes my project works but it’s not secure at all.

---

<div class="post-metadata">

**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\
**Post date:** [December 18, 2023, 3:02pm UTC](https://forum.ansible.com/t/awx-credentials-vs-credentials-type/2921/4 "2023-12-18T15:02:52Z")

</div>

Finally succeed to setup what I need according to [this blog.](https://virtualhobbit.com/2020/11/11/enabling-hashicorp-vault-lookups-in-ansible-awx-part-2/)

I already use AppRole so the thing was just to “inject” custom credential (vault URL + roleID/secretID) from AWX to my running project.

- From an AWX perspective, I simply created new credential type as mentionned [here again.](https://virtualhobbit.com/2020/11/11/enabling-hashicorp-vault-lookups-in-ansible-awx-part-2/)  
INPUT Configuration

```auto
fields:
  - id: vault_server
    type: string
    label: URL for Vault Server
  - id: vault_role_id
    type: string
    label: Vault AppRole ID
  - id: vault_secret_id
    type: string
    label: Vault Secret ID
    secret: true
required:
  - vault_server

```

Injector Configuration

```auto
env:
  VAULT_ADDR: '{{ vault_server }}'
  VAULT_ROLE_ID: '{{ vault_role_id }}'
  VAULT_SECRET_ID: '{{ vault_secret_id }}'
  VAULT_AUTH_METHOD: approle

```

- From a YAML perspective, all my projects vars embbed :

```auto
  vars:
  #Those 2 vars will lookup for ENV variables we setup through AWX
    approle_id: "{{ lookup('env','VAULT_ROLE_ID') }}"
    approle_secret_id: "{{ lookup('env','VAULT_SECRET_ID') }}"

  # This one "mount" the connection with my Vault with dedicated AppRole
    my_secret_vault: "{{ lookup('community.hashi_vault.vault_kv2_get', 'my_secret', engine_mount_point='kv/', auth_method='approle', role_id=approle_id, secret_id=approle_secret_id) }}"

  # This one retrieve the key's data based on my query
    my_key: "{{ my_secret_vault.secret.my_key_id }}"

```

So now you just need to fill the correct Vault URL + roleID + secret ID from your AWX GUI and here you go 🙂

PS : no matter if you’re using AppRole or simply token, the method works the same, you just need to adapt your injector Configuration.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [January 17, 2024, 3:02pm UTC](https://forum.ansible.com/t/awx-credentials-vs-credentials-type/2921/5 "2024-01-17T15:02:53Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.