# Combine ansible-vault with prompted variables?

**URL:** <https://forum.ansible.com/t/combine-ansible-vault-with-prompted-variables/26494>\
**Category:** Ansible Project\
**Created:** [January 16, 2018, 8:30pm UTC](https://forum.ansible.com/t/combine-ansible-vault-with-prompted-variables/26494 "2018-01-16T20:30:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [January 16, 2018, 8:30pm UTC](https://forum.ansible.com/t/combine-ansible-vault-with-prompted-variables/26494/1 "2018-01-16T20:30:31Z")

</div>

The problem I have right now is that, to use ansible-vault encrypted strings, I need to specify on the command line --vault-id=foo@prompt .

I don’t use encrypted strings very often, so I’d rather have my play notice that I’m going to use an encrypted string, and prompt for the password only when absolutely necessary.

Is this possible? Something along the lines of

vars:  
string1: !vault |  
$ANSIBLE\_VAULT;1.2;AES256;foo  
66306438623164653061623661376331643537303931663562326336386234333935373661623261  
3930633662616462316133633236383530356561346233640a386439316638313361333437386435  
38346635626533313266663436666163386238616266623038666364323232393465656665643831  
6437616339616463360a383263333965366264633562343965386137313364613737356666623562  
3033  
vars\_prompt:

- name: “cryptpasswd”  
prompt: “ansible-vault password”  
private: yes  
tasks:
- name: “secret string”  
debug:  
msg: “secret message is {{ string1 }}”

… and then my password is somehow available to decrypt the string when needed?

Thanks.